CVE-2015-5179

The ipa-enrollment SLAPI plugin in FreeIPA has a null pointer dereference vulnerability. A remote authenticated client can send a malformed LDAP extended operation, omitting the request value for JOIN_OID, causing a server crash and denial of service.

FreeIPA 4.x with API version 2.213 allows remote authenticated users to bypass intended account-locking restrictions via an unlock action with an old session ID (for the same user account) that had been created for an earlier session.

FreeIPA uses a default password policy that locks an account after 5 unsuccessful authentication attempts. This allows remote attackers to cause a denial of service by locking out the account in which system services run on.

FreeIPA version 4.4.0 allows remote attackers to request an arbitrary SAN name for services.

A flaw was found in FreeIPA. When a trust relationship is configured with Active Directory, AD users can bypass authentication for FreeIPA services by impersonating a client name in the TGS due to missing PAC certificate verification. This could allow an authenticated AD user to escalate privileges within the FreeIPA domain.

A privilege escalation from host to domain vulnerability was found in FreeIPA. The lack of uniqueness validation for the `krbCanonicalName` attribute of the admin account allows creating a service with the same canonical name as the REALM admin. A successful attack lets the attacker obtain a Kerberos ticket with admin@REALM credentials.

In FreeIPA before version 4.2.2, the ipa-kra-install script places the CA agent certificate and private key in /etc/httpd/alias/kra-agent.pem, which is world readable.

A flaw in FreeIPA allows a remote unauthenticated attacker to exploit the `/ipa/i18n_messages` endpoint by sending an arbitrarily large request body, causing excessive memory consumption, memory exhaustion, and denial of service.

A flaw in FreeIPA allows a remote unauthenticated attacker to send oversized form POST requests to `/ipa/migration/migration.py`, forcing the migration handler to read attacker-controlled bodies fully into memory, leading to increased memory usage, slower handling, and potential DoS.

FreeIPA has a vulnerability due to lack of size limits for OTP key values. A low-privilege authenticated user can submit an oversized OTP key, causing excessive CPU and memory consumption, leading to denial of service.