CVE-2015-1827: Medium severity FreeIPA FreeIPA vulnerability
It was discovered that the IPA extdom Directory Server plug-in did not correctly perform memory reallocation when handling user account information. A request for a list of groups for a user that belongs to a large number of groups would cause a Directory Server to crash.
Acknowledgements:
This issue was discovered by Sumit Bose of Red Hat.
Other sources
The getusergrouplist function in the extdom plug-in in FreeIPA before 4.1.4 does not properly reallocate memory when processing user accounts, which allows remote attackers to cause a denial of service (crash) via a group list request for a user that belongs to a large number of groups.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-1827?
CVE-2015-1827 has a medium severity rating as it can cause a denial of service for the Directory Server.
How do I fix CVE-2015-1827?
To mitigate CVE-2015-1827, upgrade FreeIPA to a version later than 4.1.3.
Which software is affected by CVE-2015-1827?
CVE-2015-1827 affects FreeIPA versions up to and including 4.1.3 and specific versions of Fedora 21 and 22.
What exploit does CVE-2015-1827 expose in the Directory Server?
CVE-2015-1827 exposes the Directory Server to a crash due to improper memory reallocation when handling requests for users in large groups.
Is there a workaround for CVE-2015-1827?
There are no documented workarounds for CVE-2015-1827; the recommended action is to apply the necessary updates.