FreeIPA Flaw Chain Lets Anonymous Clients Create Reusable Administrator Credentials
Overview
A vulnerability in FreeIPA, a system used for managing user identities in Linux domains, allows unauthenticated clients to create their own Kerberos identities. This flaw could enable an attacker to gain access to the administrators group without ever having logged in. The exploit relies on a second vulnerability in the 389 Directory Server, which FreeIPA uses to store identity information. Red Hat has acknowledged the issue, which poses a significant risk to systems that rely on FreeIPA for user management. Organizations using FreeIPA should prioritize addressing this flaw to prevent unauthorized administrative access.
Key Takeaways
- Affected Systems: FreeIPA, 389 Directory Server
- Action Required: Users should apply any available patches for FreeIPA and the 389 Directory Server, and review access controls to prevent unauthorized identity creation.
- Timeline: Newly disclosed
Original Article Summary
A flaw in FreeIPA lets a client that has never logged in create a Kerberos identity of its own choosing in the directory and end up in the administrators group, Red Hat says. FreeIPA is the system that determines who may log in across a Linux domain and maintains all identities in a 389 Directory Server database accessed via LDAP. The attack needs a second flaw in that database software. The
Impact
FreeIPA, 389 Directory Server
Exploitation Status
The exploitation status is currently unknown. Monitor vendor advisories and security bulletins for updates.
Timeline
Newly disclosed
Remediation
Users should apply any available patches for FreeIPA and the 389 Directory Server, and review access controls to prevent unauthorized identity creation.
Additional Information
This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.
Related Topics: This incident relates to Linux, Exploit, Vulnerability, and 1 more.