Description
The default LDAP ACIs in FreeIPA 3.0 before 3.1.2 do not restrict access to the (1) ipaNTTrustAuthIncoming and (2) ipaNTTrustAuthOutgoing attributes, which allow remote attackers to obtain the Cross-Realm Kerberos Trust key via unspecified vectors.
References
- 57542 vdb-entry
- http://www.freeipa.org/page/Releases/3.1.2
- freeipa-crossrealm-info-disc(81486) vdb-entry
- 89539 vdb-entry
- http://www.freeipa.org/page/CVE-2013-0199