CVE-2015-5284#

Summary#

The ipa-kra-install command, which configures KRA for IPA, puts the CA agent certificate and private key to a world readable file, /etc/httpd/alias/kra-agent.pem. This allows users on an IPA server where ipa-kra-install was run to issue arbitrary certificates with the IPA CA.

Affected Versions#

4.2.0 and 4.2.1

Impact#

Important

Fixed in Versions#

4.2.2

Manual Instructions#

Uninstall KRA and remove /etc/httpd/alias/kra-agent.pem on all IPA servers:

# ipa-kra-install --uninstall
# rm -f /etc/httpd/alias/kra-agent.pem

Create new CA agent certificate and private key on the CA master IPA server:

Use the following command to identify which IPA server is the CA master:

$ ldapsearch -H ``\ ```ldap://$HOSTNAME <ldap://$HOSTNAME>`__`` -D ‘cn=Directory Manager’ -W -b cn=masters,cn=ipa,cn=etc,BASE_DN ‘(ipaConfigString=caRenewalMaster)’ dn``

BASE_DN is the LDAP base DN configured for your IPA domain, you can find its value in /etc/ipa/default.conf in the [global] section under the basedn key.

Find the subject name and serial number of the CA agent certificate:

# pki cert-find --name 'IPA RA' --status VALID
---------------
1 entries found
---------------
  Serial Number:  OLD_SERIAL
  Subject DN:  SUBJECT
  Status: VALID
  Type: X.509 version 3
  Key Algorithm: PKCS #1 RSA with 2048-bit key
  Not Valid Before: Tue Oct 06 12:45:01 CEST 2015
  Not Valid After: Mon Sep 25 12:45:01 CEST 2017
  Issued On: Tue Oct 06 13:22:14 CEST 2015
  Issued By: ipara
----------------------------
Number of entries returned 1
----------------------------

Note the subject name and serial number in the output of this command.

Create new temporary NSS database:

# mkdir /root/tmpdb
# certutil -d /root/tmpdb -N
Enter a password which will be used to encrypt your keys.
The password should be at least 8 characters long,
and should contain at least one non-alphabetic character.
Enter new password:
Re-enter password:

Create new CA agent private key and certificate request:

# certutil -d /root/tmpdb -R -k rsa -g 2048 -s 'SUBJECT' -o /root/ca-agent.csr
Enter Password or Pin for "NSS Certificate DB":
A random seed must be generated that will be used in the
creation of your key.  One of the easiest ways to create a
random seed is to use the timing of keystrokes on a keyboard.
To begin, type keys on the keyboard until this progress meter
is full.  DO NOT USE THE AUTOREPEAT FUNCTION ON YOUR KEYBOARD!
Continue typing until the progress meter is full:
|************************************************************|
Finished.  Press enter to continue:
Generating key.  This may take a few moments...

Request new CA agent certificate from the CA:

# curl "http://$HOSTNAME:8080/ca/ee/ca/profileSubmit" --data-urlencode profileId=caServerCert --data-urlencode cert_request_type=pkcs10 --data-urlencode requestor_name="IPA Installer" --data-urlencode cert_request="$(base64 -w 0 /root/ca-agent.csr)" --data-urlencode xmlOutput=true

2Request Deferred - {0} REQUEST_ID

Note the request id in the output of this command, inside the <RequestId> tag.

Issue the new CA agent certificate:

# pki -d /etc/httpd/alias -C /etc/httpd/alias/pwdfile.txt -n ipaCert cert-request-review REQUEST_ID --action approve
-------------------------------
Approved certificate request  REQUEST_ID
-------------------------------
  Request ID:  REQUEST_ID
  Type: enrollment
  Request Status: complete
  Operation Result: success
  Certificate ID:  NEW_SERIAL

Note the serial number in the output of this command (shown as “Certificate ID”).

Revoke the old CA agent certificate:

# pki -d /etc/httpd/alias -C /etc/httpd/alias/pwdfile.txt -n ipaCert cert-revoke OLD_SERIAL --reason Key_Compromise
Revoking certificate:
  Serial Number:  OLD_SERIAL
  Issuer:  ISSUER
  Subject:  SUBJECT
  Status: VALID
  Not Before: Tue Oct 06 08:44:30 CEST 2015
  Not After: Mon Sep 25 08:44:30 CEST 2017
Are you sure (Y/N)? y
-------------------------
Revoked certificate "OLD_SERIAL"
-------------------------
  Serial Number:  OLD_SERIAL
  Issuer:  ISSUER
  Subject:  SUBJECT
  Status: REVOKED
  Not Before: Tue Oct 06 08:44:30 CEST 2015
  Not After: Mon Sep 25 08:44:30 CEST 2017

Retrieve the new CA agent certificate from the CA:

# pki cert-show NEW_SERIAL --output /root/ca-agent.crt
-----------------
Certificate "NEW_SERIAL"
-----------------
  Serial Number:  NEW_SERIAL
  Issuer:  ISSUER
  Subject:  SUBJECT
  Status: VALID
  Not Before: Tue Oct 06 12:45:01 CEST 2015
  Not After: Mon Sep 25 12:45:01 CEST 2017

Note the issuer name and subject name in the output of this command.

Replace the old CA agent certificate in LDAP:

# openssl x509 -in /root/ca-agent.crt -out /root/ca-agent.der -outform DER
# ldapmodify -H ``\ ```ldap://$HOSTNAME`` <ldap://$HOSTNAME>`__\ `` -D 'cn=Directory Manager' -W
Enter LDAP Password:
dn: uid=ipara,ou=people,o=ipaca
changetype: modify
replace: userCertificate
| ``userCertificate:< ``\ ```file:///root/ca-agent.der`` <file:///root/ca-agent.der>`__
-
replace: description
description: 2; NEW_SERIAL_DEC ; ISSUER ; SUBJECT
dn: cn=ipaCert,cn=ca_renewal,cn=ipa,cn=etc, BASE_DN
changetype: modify
replace: userCertificate
| ``userCertificate:< ``\ ```file:///root/ca-agent.der`` <file:///root/ca-agent.der>`__

NEW_SERIAL_DEC is NEW_SERIAL converted from hexadecimal to decimal. The second mod (cn=ipaCert,cn=ca_renewal,cn=ipa,cn=etc,BASE_DN) may fail with “No such object” error, which can be safely ignored.

Create a PKCS#12 file with the new CA agent private key and certificate:

# certutil -d /root/tmpdb -A -n ipaCert -t ,, -a -i /root/ca-agent.crt
# pk12util -o /root/ca-agent.p12 -n ipaCert -d /root/tmpdb
Enter Password or Pin for "NSS Certificate DB":
Enter password for PKCS12 file:
Re-enter password:
pk12util: PKCS12 EXPORT SUCCESSFUL

Replace the old CA agent certificate and private key in /etc/httpd/alias with the new CA agent certificate and private key:

# certutil -d /etc/httpd/alias -D -n ipaCert
# pk12util -i /root/ca-agent.p12 -d /etc/httpd/alias -k /etc/httpd/alias/pwdfile.txt
Enter password for PKCS12 file:
pk12util: PKCS12 IMPORT SUCCESSFUL

Restart httpd:

``# systemctl restart httpd``

Import the new CA agent certificate and private key on the remaining IPA servers:

Copy /root/ca-agent.p12 from the CA master IPA server to the current IPA server.
Replace the old CA agent certificate and private key in /etc/httpd/alias with the new CA agent certificate and private key:

# certutil -d /etc/httpd/alias -D -n ipaCert

# pk12util -i /root/ca-agent.p12 -d /etc/httpd/alias -k /etc/httpd/alias/pwdfile.txt
Enter password for PKCS12 file:
pk12util: PKCS12 IMPORT SUCCESSFUL

Restart httpd:

``# systemctl restart httpd``

More Information#

For more information see

CVE-2015-5284

Contents

CVE-2015-5284#

CVE-2015-5284#

Summary#

Affected Versions#

Impact#

Fixed in Versions#

Manual Instructions#

More Information#