CVE-2016-7030: High severity red hat freeipa vulnerability
A flaw was found that allows any unauthenticated party to easily run DoS attack against kerberized services in FreeIPA/IdM realm.
FreeIPA contains MIT KDC as its main component + FreeIPA is using custom database driver for the KDC. As a side-effect of implementation, FreeIPA is enforcing password policies for all principals, including services which do not use "password" but keytab with randomly-generated/strong key.
Default password policy locks an account after 5 unsuccessful authentication attempts for 10 minutes. An attacker can use this to simply lock-out any principal, including system services.
Upstream patch : https://git.fedorahosted.org/cgit/freeipa.git/commit/?id=6f1d927467e7907fd1991f88388d96c67c9bff61
Additional dependency : https://git.fedorahosted.org/cgit/freeipa.git/commit/?id=73f33569c8893610e246b2f44a7aeaec872b37e6
Other sources
FreeIPA uses a default password policy that locks an account after 5 unsuccessful authentication attempts, which allows remote attackers to cause a denial of service by locking out the account in which system services run on.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-7030?
CVE-2016-7030 is classified as a high-severity vulnerability due to its potential to allow unauthenticated parties to perform DoS attacks.
How does CVE-2016-7030 affect FreeIPA users?
CVE-2016-7030 allows attackers to easily launch denial-of-service attacks against kerberized services within the FreeIPA/IdM realm.
How do I fix CVE-2016-7030?
To mitigate CVE-2016-7030, update FreeIPA to a fixed version that addresses this vulnerability, particularly versions above 4.6.0.
Can CVE-2016-7030 be exploited remotely?
Yes, CVE-2016-7030 can be exploited remotely since it allows any unauthenticated party to target kerberized services.
What components of FreeIPA are impacted by CVE-2016-7030?
CVE-2016-7030 impacts the MIT KDC component of FreeIPA, particularly when using its custom database driver.