CVEvulnerability
CVE-2013-0199
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2014-05-29
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-264
Description
The default LDAP ACIs in FreeIPA 3.0 before 3.1.2 do not restrict access to the (1) ipaNTTrustAuthIncoming and (2) ipaNTTrustAuthOutgoing attributes, which allow remote attackers to obtain the Cross-Realm Kerberos Trust key via unspecified vectors.
Affected configurations
• redhat freeipa 3.0.0
• redhat freeipa 3.0.1
• redhat freeipa 3.0.2
• redhat freeipa 3.1.1
Related
Weakness · not in database (1)
References
- http://osvdb.org/89539 osvdb.org
- http://www.freeipa.org/page/CVE-2013-0199 Patch, Vendor Advisory
- http://www.freeipa.org/page/Releases/3.1.2 www.freeipa.org
- http://www.securityfocus.com/bid/57542 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/81486 exchange.xforce.ibmcloud.com
- http://osvdb.org/89539 osvdb.org
- http://www.freeipa.org/page/CVE-2013-0199 Patch, Vendor Advisory
- http://www.freeipa.org/page/Releases/3.1.2 www.freeipa.org
- http://www.securityfocus.com/bid/57542 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/81486 exchange.xforce.ibmcloud.com