Vulnerability Name:

CVE-2019-14867 (CCN-172282)

Assigned:2019-08-26
Published:2019-08-26
Updated:2020-02-05
Summary:A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way the internal function ber_scanf() was used in some components of the IPA server, which parsed kerberos key data. An unauthenticated attacker who could trigger parsing of the krb principal key could cause the IPA server to crash or in some conditions, cause arbitrary code to be executed on the server hosting the IPA server.
CVSS v3 Severity:8.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
7.7 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
8.8 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
7.7 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
8.8 High (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
7.7 High (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
9.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-400
CWE-94
CWE-94
CWE-400
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2019-14867

Source: CCN
Type: FreeIPA Web site
FreeIPA

Source: REDHAT
Type: UNKNOWN
RHBA-2019:4268

Source: REDHAT
Type: UNKNOWN
RHSA-2020:0378

Source: CCN
Type: Red Hat Bugzilla – Bug 1766920
(CVE-2019-14867) - CVE-2019-14867 ipa: Denial of service in IPA server due to wrong use of ber_scanf()

Source: CONFIRM
Type: Issue Tracking, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14867

Source: XF
Type: UNKNOWN
ipa-cve201914867-code-exec(172282)

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2019-c64e1612f5

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2019-8e9093da55

Source: MISC
Type: Release Notes
https://www.freeipa.org/page/Releases/4.6.7

Source: MISC
Type: Release Notes
https://www.freeipa.org/page/Releases/4.7.4

Source: MISC
Type: Release Notes
https://www.freeipa.org/page/Releases/4.8.3

Vulnerable Configuration:Configuration 1:
  • cpe:/a:freeipa:freeipa:*:*:*:*:*:*:*:* (Version >= 4.6.0 and < 4.6.7)
  • OR cpe:/a:freeipa:freeipa:*:*:*:*:*:*:*:* (Version >= 4.7.0 and < 4.7.4)
  • OR cpe:/a:freeipa:freeipa:*:*:*:*:*:*:*:* (Version >= 4.8.0 and < 4.8.3)

    • Configuration 2:
  • cpe:/o:fedoraproject:fedora:30:*:*:*:*:*:*:*
  • OR cpe:/o:fedoraproject:fedora:31:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/a:redhat:enterprise_linux:8:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/a:redhat:enterprise_linux:8::appstream:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:com.redhat.rhsa:def:20200378
    P
    		RHSA-2020:0378: ipa security and bug fix update (Important)
    2020-02-04
    oval:com.redhat.rhba:def:20194268
    P
    		RHBA-2019:4268: idm:DL1 bug fix update (Important)
    2019-12-17
    oval:com.ubuntu.disco:def:2019148670000000
    V
    		CVE-2019-14867 on Ubuntu 19.04 (disco) - medium.
    2019-11-27
    oval:com.ubuntu.bionic:def:2019148670000000
    V
    		CVE-2019-14867 on Ubuntu 18.04 LTS (bionic) - medium.
    2019-11-27
    oval:com.ubuntu.xenial:def:2019148670000000
    V
    		CVE-2019-14867 on Ubuntu 16.04 LTS (xenial) - medium.
    2019-11-27
    BACK
    freeipa freeipa *
    freeipa freeipa *
    freeipa freeipa *
    fedoraproject fedora 30
    fedoraproject fedora 31