REDHAT-BUG-1370493: Medium severity FreeIPA FreeIPA vulnerability
A flaw was found that allows any unauthenticated party to easily run DoS attack against kerberized services in FreeIPA/IdM realm.
FreeIPA contains MIT KDC as its main component + FreeIPA is using custom database driver for the KDC. As a side-effect of implementation, FreeIPA is enforcing password policies for all principals, including services which do not use "password" but keytab with randomly-generated/strong key.
Default password policy locks an account after 5 unsuccessful authentication attempts for 10 minutes. An attacker can use this to simply lock-out any principal, including system services.
Upstream patch : https://git.fedorahosted.org/cgit/freeipa.git/commit/?id=6f1d927467e7907fd1991f88388d96c67c9bff61
Additional dependency : https://git.fedorahosted.org/cgit/freeipa.git/commit/?id=73f33569c8893610e246b2f44a7aeaec872b37e6
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1370493?
The severity of REDHAT-BUG-1370493 is considered critical due to its potential for remote denial-of-service attacks.
How do I fix REDHAT-BUG-1370493?
To fix REDHAT-BUG-1370493, it is recommended to update FreeIPA to the latest patched version released by the vendor.
What services are affected by REDHAT-BUG-1370493?
REDHAT-BUG-1370493 affects kerberized services within the FreeIPA/IdM realm.
Who can exploit REDHAT-BUG-1370493?
Any unauthenticated party can exploit REDHAT-BUG-1370493 to perform a denial-of-service attack on affected services.
Is there a workaround for REDHAT-BUG-1370493?
Currently, there are no known workarounds for REDHAT-BUG-1370493 other than applying the available updates.