CVE-2013-0199

Published: May 29, 2014Modified: May 6, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

The default LDAP ACIs in FreeIPA 3.0 before 3.1.2 do not restrict access to the (1) ipaNTTrustAuthIncoming and (2) ipaNTTrustAuthOutgoing attributes, which allow remote attackers to obtain the Cross-Realm Kerberos Trust key via unspecified vectors.

Affected (4)

Products: Redhat: Freeipa

Redhat

1 product

Freeipa

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Redhat Freeipa	Version 3.0.0
Redhat Freeipa	Version 3.0.1
Redhat Freeipa	Version 3.0.2
Redhat Freeipa	Version 3.1.1

Related CWEs

CWE-264

References (10)

http://osvdb.org/89539

Source: secalert@redhat.com

http://www.freeipa.org/page/CVE-2013-0199

Source: secalert@redhat.com

PatchVendor Advisory

http://www.freeipa.org/page/Releases/3.1.2

Source: secalert@redhat.com

http://www.securityfocus.com/bid/57542

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/81486

Source: secalert@redhat.com

http://osvdb.org/89539