Vulnerability Name:

CVE-2017-2590 (CCN-123957)

Assigned:2016-12-01
Published:2017-02-27
Updated:2019-10-09
Summary:A vulnerability was found in ipa before 4.4. IdM's ca-del, ca-disable, and ca-enable commands did not properly check the user's permissions while modifying CAs in Dogtag. An authenticated, unauthorized attacker could use this flaw to delete, disable, or enable CAs causing various denial of service problems with certificate issuance, OCSP signing, and deletion of secret keys.
CVSS v3 Severity:8.1 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
7.1 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): High
Availibility (A): High
8.1 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
7.1 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): High
Availibility (A): High
8.1 High (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
7.1 High (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:5.5 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): Partial
8.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-275
CWE-732
Vulnerability Consequences:Gain Privileges
References:Source: MITRE
Type: CNA
CVE-2017-2590

Source: CCN
Type: RHSA-2017-0388
Moderate: ipa security and bug fix update

Source: REDHAT
Type: Third Party Advisory
RHSA-2017:0388

Source: BID
Type: Third Party Advisory, VDB Entry
96557

Source: CCN
Type: BID-96557
FreeIPA CVE-2017-2590 Multiple Security Bypass Vulnerabilities

Source: CCN
Type: Red Hat Bugzilla
Bug 1413137 - (CVE-2017-2590) CVE-2017-2590 ipa: Insufficient permission check for ca-del, ca-disable and ca-enable commands

Source: CONFIRM
Type: Issue Tracking, Patch
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2590

Source: XF
Type: UNKNOWN
freeipa-cve20172590-priv-esc(123957)

Source: CCN
Type: FreeIPA Web site
FreeIPA

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2017-2590

Vulnerable Configuration:Configuration 1:
  • cpe:/a:freeipa:freeipa:*:*:*:*:*:*:*:* (Version < 4.4.0)

    • Configuration 2:
  • cpe:/o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_server_eus:7.3:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:7:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/o:redhat:enterprise_linux:7::client:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:7::computenode:*:*:*:*:*

    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:7::server:*:*:*:*:*

    • Configuration RedHat 5:
  • cpe:/o:redhat:enterprise_linux:7::workstation:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:freeipa:freeipa:-:*:*:*:*:*:*:*
  • AND
  • cpe:/o:redhat:enterprise_linux_desktop:7:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_hpc_node:7:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_server:7:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_workstation:7:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:com.ubuntu.cosmic:def:201725900000000
    V
    		CVE-2017-2590 on Ubuntu 18.10 (cosmic) - medium.
    2018-07-27
    oval:com.ubuntu.bionic:def:201725900000000
    V
    		CVE-2017-2590 on Ubuntu 18.04 LTS (bionic) - medium.
    2018-07-27
    oval:com.ubuntu.trusty:def:20172590000
    V
    		CVE-2017-2590 on Ubuntu 14.04 LTS (trusty) - medium.
    2018-07-27
    oval:com.ubuntu.xenial:def:201725900000000
    V
    		CVE-2017-2590 on Ubuntu 16.04 LTS (xenial) - medium.
    2018-07-27
    oval:com.ubuntu.bionic:def:20172590000
    V
    		CVE-2017-2590 on Ubuntu 18.04 LTS (bionic) - medium.
    2018-07-27
    oval:com.ubuntu.xenial:def:20172590000
    V
    		CVE-2017-2590 on Ubuntu 16.04 LTS (xenial) - medium.
    2018-07-27
    oval:com.ubuntu.cosmic:def:20172590000
    V
    		CVE-2017-2590 on Ubuntu 18.10 (cosmic) - medium.
    2018-07-27
    oval:com.redhat.rhsa:def:20170388
    P
    		RHSA-2017:0388: ipa security and bug fix update (Moderate)
    2017-03-02
    oval:com.ubuntu.precise:def:20172590000
    V
    		CVE-2017-2590 on Ubuntu 12.04 LTS (precise) - medium.
    2017-03-01
    oval:com.ubuntu.artful:def:20172590000
    V
    		CVE-2017-2590 on Ubuntu 17.10 (artful) - medium.
    2017-03-01
    BACK
    freeipa freeipa *
    redhat enterprise linux 7.0
    redhat enterprise linux desktop 7.0
    redhat enterprise linux server 7.0
    redhat enterprise linux server aus 7.3
    redhat enterprise linux server aus 7.4
    redhat enterprise linux server eus 7.3
    redhat enterprise linux server eus 7.4
    redhat enterprise linux server eus 7.5
    redhat enterprise linux workstation 7.0
    freeipa freeipa -
    redhat enterprise linux desktop 7
    redhat enterprise linux hpc node 7
    redhat enterprise linux server 7
    redhat enterprise linux workstation 7
    redhat enterprise linux server tus 7.3