CVE-2012-5484#

CVE-2012-5484: MITM Attack during Join process#

A weakness was found in the way an IPA client communicates with an IPA server when attempting to join an IPA domain.

When an IPA client attempts to join an IPA domain an attacker could run a Man in The Middle Attack to try to intercept and hijack initial communication. A join initiated by an administrative user would grant the attacker administrative rights to the IPA server, whereas a join initiated by an unprivileged user would only grant the attacker limited privilege (typically just the ability to join the domain).

The weakness is caused by the way the CA certificate is retrieved from the server. The following SSL communication may then be intercepted and subverted.

Note that no credentials are exposed through this attack and it is effective only if performed during the join procedure and network traffic can be redirected or intercepted. Mere observation of the network traffic is not sufficient to grant an attacker any privilege.

Affected Versions#

All 2.x and 3.x versions

Impact#

Low

Acknowledgements#

The FreeIPA team would like to thank Petr Menšík for reporting this issue.

Upgrade instructions#

The resolution for this issue consist in allowing clients to download the CA certificate exclusively via a mutually authenticated LDAP connection or by providing the CA cert via an external method to the client. At least one IPA server in a domain need to be updated using the provided patches, so that the CA certificate is made available via LDAP. All client should be upgraded to use the updated ipa-client-install script that downloads the CA cert via an authenticated LDAP connection.

Patches#

Patches to resolve this issue are available through our git repository:

Category:CVEs

CVE-2012-5484