PT-2008-4688 · Red Hat · Red Hat Enterprise Ipa+1
CVE-2008-3274
·
Publicado
2008-09-12
·
Atualizado
2023-02-13
CVSS v2.0
5.0
Média
| Vetor | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions:
Red Hat Enterprise IPA version 1.0.0
FreeIPA versions prior to 1.1.1
Description:
The default configuration of the affected software places ldap:///anyone on the read ACL for the krbMKey attribute. This allows remote attackers to obtain the Kerberos master key via an anonymous LDAP query.
Recommendations:
For Red Hat Enterprise IPA version 1.0.0, update the configuration to restrict access to the krbMKey attribute.
For FreeIPA versions prior to 1.1.1, update to version 1.1.1 or later to fix the issue.
Correção
Information Disclosure
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Freeipa
Red Hat Enterprise Ipa