CVE-2016-9575: Medium severity red hat freeipa vulnerability
Due to a missing permission check, certprofile-mod can be used by an authenticated but unprivileged user to modify certificate profile configuration. This could allow the issuance of certificates with fraudulent subject naming information (allowing the holder of the private key to impersonate another entity), or inappropriate key usage or extended key usage information (use of certificate for unauthorised purposes e.g. code signing).
Affected versions : 4.2 and above (all versions supporting certificate profiles)
Upstream patch : https://git.fedorahosted.org/cgit/freeipa.git/commit/?id=fec4c32ff15a96736740cf7d2f713a21af0b227e
Other sources
Ipa versions 4.2.x, 4.3.x before 4.3.3 and 4.4.x before 4.4.3 did not properly check the user's permissions while modifying certificate profiles in IdM's certprofile-mod command. An authenticated, unprivileged attacker could use this flaw to modify profiles to issue certificates with arbitrary naming or key usage information and subsequently use such certificates for other attacks.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9575?
CVE-2016-9575 is classified as a medium severity vulnerability due to the potential for unprivileged users to modify certificate profiles.
How do I fix CVE-2016-9575?
To fix CVE-2016-9575, upgrade the FreeIPA software to a version that is 4.4.3 or later.
What versions of FreeIPA are affected by CVE-2016-9575?
CVE-2016-9575 affects FreeIPA versions 4.2.0 through 4.4.2.
What can an attacker achieve by exploiting CVE-2016-9575?
Exploiting CVE-2016-9575 allows an attacker to issue fraudulent certificates by modifying the certificate profile configuration.
Who can exploit CVE-2016-9575?
CVE-2016-9575 can be exploited by any authenticated but unprivileged user within the affected systems.