RHSA-2013:0528 - Security Advisory

Topic

Updated ipa packages that fix one security issue, several bugs, and add
various enhancements are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having low
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

Description

Red Hat Identity Management is a centralized authentication, identity
management and authorization solution for both traditional and cloud-based
enterprise environments. It integrates components of the Red Hat Directory
Server, MIT Kerberos, Red Hat Certificate System, NTP, and DNS. It provides
web browser and command-line interfaces. Its administration tools allow an
administrator to quickly install, set up, and administer a group of domain
controllers to meet the authentication and identity management requirements
of large-scale Linux and UNIX deployments.

It was found that the current default configuration of IPA servers did not
publish correct CRLs (Certificate Revocation Lists). The default
configuration specifies that every replica is to generate its own CRL;
however, this can result in inconsistencies in the CRL contents provided to
clients from different Identity Management replicas. More specifically, if
a certificate is revoked on one Identity Management replica, it will not
show up on another Identity Management replica. (CVE-2012-4546)

These updated ipa packages also include numerous bug fixes and
enhancements. Space precludes documenting all of these changes in this
advisory. Users are directed to the Red Hat Enterprise Linux 6.4 Technical
Notes, linked to in the References, for information on the most significant
of these changes.

Users are advised to upgrade to these updated ipa packages, which fix these
issues and add these enhancements.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

• BZ - 748987 - If master has leftover replica agreement from a previous failed attempt, next replica install can fail
• BZ - 766095 - [RFE] UI for SELinux user mapping
• BZ - 767723 - [RFE] Implement ipa web GUI to create trusts
• BZ - 768510 - migrate-ds : misleading error message when invalid objectclass defined
• BZ - 773490 - dns discovery domain needs to be added to sssd.conf
• BZ - 781208 - ipa user-find --manager does not find matches
• BZ - 782847 - ipa permission-mod prompts for all parameters
• BZ - 782981 - [RFE] Form based auth page needs to support password changes too
• BZ - 783274 - [RFE] Create NIS map for ethers table
• BZ - 784378 - Run CLEANRUV task when completely deleting a replica
• BZ - 784621 - [ipa webui] Reset password link is enabled for a user without permission to change it
• BZ - 785251 - ipa permisison-find --name brings back all permissions
• BZ - 785254 - ipa permission-find --subtree brings back all permissions
• BZ - 785257 - ipa permission-find --sizelimit is disregarded
• BZ - 786199 - [RFE] CLI session support (Store session cookie in ccache for cli users)
• BZ - 796390 - ipa netgroup-add with both --desc and --addattr=description returns internal error
• BZ - 798355 - Fill DNS update policy by default
• BZ - 798363 - [RFE] add in UI of "create password policy" measurement unit examples
• BZ - 798365 - defect: add in UI of "policy" -> "kerberos ticket policy" measurement unit examples
• BZ - 798493 - adding reverse zones in gui fails to create correct zone
• BZ - 801931 - [RFE] Expand current 'update dns entries' permission to be per-domain level?
• BZ - 804619 - DNS zone serial number is not updated
• BZ - 805203 - set ipa_hostname for sssd.conf
• BZ - 805233 - [RFE] Prevent deletion of the last admin
• BZ - 805430 - IPA dnszone-add does not accept the utmost valid serial number.
• BZ - 807018 - ipa config-mod should not be allowed to modify certificate subject base
• BZ - 809562 - Constraints for CNAME records are not enforced
• BZ - 809565 - Cannot change DNS name without recreating it
• BZ - 811207 - [ipa webui] When permission Type is updated, attributes should reflect new Type
• BZ - 811211 - [ipa webui] Refresh issue with re-adding objects with same name as deleted objects
• BZ - 811295 - Installation fails when CN is set in certificate subject base
• BZ - 813325 - ipa netgroup-mod addattr and setattr allow invalid characters for externalHost
• BZ - 813402 - [RFE] Warn users in UI when password is going to expire in n days
• BZ - 814785 - [ipa webui] Update Unsaved Changes for Netgroups
• BZ - 815364 - [ipa webui] DNS permissions not listed and are in lowercase
• BZ - 815481 - hostgroup and netgroup names with one letter not allowed
• BZ - 815494 - [ipa webui] Netgroups page does not have members listed as links
• BZ - 815830 - [WebUI] Unsaved changes dialog appers more than once in some cases
• BZ - 815849 - ipa-server-install unhandled exception with unclear error messages (inside DNS check)
• BZ - 816574 - ipa permission-add throws internal server error when --addattr or --setattr is blank
• BZ - 816624 - ipa privilege-remove-permission with blank permission throws internal error
• BZ - 817075 - ipa-server-install: s/calculated/determined/
• BZ - 817080 - ipa-server-install --uninstall doesn't clear certmonger dirs, which leads to install failing
• BZ - 817407 - [Web UI] Password policies are not sorted properly
• BZ - 817412 - there is no permission/privilege for modifying automount keys
• BZ - 817413 - validate that domain name uses only valid characters
• BZ - 817821 - ipa config-mod --delattr misleading invalid error messages
• BZ - 817831 - ipa config-mod --delattr user and group search fields returns internal server error
• BZ - 817865 - we should not influence ip address family selection (traceback when IPv6 disabled)
• BZ - 817869 - Clean keytabs before installing new keys into them
• BZ - 817885 - Internal error : ipa config-mod addattr on user and group objectclasses
• BZ - 818665 - [ipa webui] Unprovisioning keytab does not have cancel option
• BZ - 818714 - [ipa webui] Instructions to generate cert should include specifying size of private key
• BZ - 818836 - ipa pwpolicy-find displays incorrect max and min lifetime.
• BZ - 819629 - Enable persistent search in bind-dyndb-ldap during IPA upgrade
• BZ - 819635 - Fix help string for DNS zone --forwarder option
• BZ - 820983 - Nested search facets have wrong tab name
• BZ - 821448 - RFE: Browser config javascript should check to see if sending Referer is enabled
• BZ - 822608 - Passwords cannot be migrated
• BZ - 823657 - ipa-replica-manage connect fails with GSSAPI error after delete if using previous kerberos ticket
• BZ - 824074 - Create ipaserver-upgrade.log on upgrades
• BZ - 824488 - Add 'disable_last_success' and 'disable_lockout' to the ipadb.so dblibrary
• BZ - 824490 - WinSync users who have First.Last casing creates users who can have their password set
• BZ - 824492 - Cannot re-connect replica to previously disconnected master
• BZ - 826152 - zonemgr is set to default for reverse zone even with --zonemgr
• BZ - 826677 - IPA cannot remove disconnected replica data to reconnect
• BZ - 827162 - ipa-client uninstall causes a crash after installing using --preserve-sssd
• BZ - 827321 - ipa-server-install does not fill the default value for --subject option and it crashes later.
• BZ - 827392 - Host OTP :: Random password characters should be limited.
• BZ - 827583 - [ipa webui] DNS Zones - Add - on IE does not open a Add window, and instead writes on top on existing page
• BZ - 828687 - Unable to update dns when deleting host
• BZ - 829070 - ipa-server-install --uninstall does not remove /var/lib/sss/pubconf/kdcinfo.$REALM
• BZ - 829746 - [ipa webui] IE - Add members dialog box cannot be resized
• BZ - 829899 - [ipa webui] IE - Attribute listing when adding permission or delegation is not displayed same as FF
• BZ - 830598 - ipa-server-install --uninstall not stopping sssd and seeing ipa-replica-conncheck kinit errors
• BZ - 830817 - [ipa webui] IE - Add permission of type Subtree, has a smaller textarea for subtree than FF
• BZ - 831010 - [RFE] ipa-client-install always adds _srv_ entry to sssd.conf even when server specified.
• BZ - 831227 - [ipa webui] IE - Unable to Edit Service, and intermittently add service fails
• BZ - 831299 - [ipa webui] IE -Scrollbar jumps back when checkbox'ing an object
• BZ - 831313 - ipa-replica-install enable GSSAPI for replication list index out of range failure
• BZ - 831661 - ipa-replica-manage re-initialize update failed due to named ldap timeout
• BZ - 832243 - Sporadic JSON errors under MSIE
• BZ - 833505 - ipa-client-install crashes when --hostname is given
• BZ - 833515 - permissions of replica files should be 0600
• BZ - 833516 - Ipactl exception not handled well in ipactl
• BZ - 833517 - [RFE] [Web UI] Add support for DNS per-domain permissions
• BZ - 835642 - mail attribute not automatically populated
• BZ - 837357 - Attributelevelrights differs in permission-show and permission-mod for the same permission
• BZ - 837358 - Don't display: Logged in as: user@FREEIPA.ORG
• BZ - 837365 - CLEANALLRUV must deal with offline replicas and older replicas
• BZ - 837380 - Add group external member support to Web UI
• BZ - 839008 - Indirect roles not checked for in WebUI
• BZ - 839638 - ipa-replica-manage allows disconnect of last connection for a single replica
• BZ - 840657 - sshpubkey not accepting ssh keys in the right format for user
• BZ - 845405 - ipa-replica-install httpd restart failed
• BZ - 845691 - ipa-client-install Failed to obtain host TGT
• BZ - 846309 - Prevent disabling last admin
• BZ - 852480 - automountkey is not indexed
• BZ - 854321 - Password policies are sorted lexicographically instead of numerically
• BZ - 854325 - Time synchronization is disabled in ipa-client-install
• BZ - 855278 - I'm getting jQuery error when adding command includes "??" into the sudo commands field in IPA web interface.
• BZ - 856282 - [Web UI] Improve instructions to generate certificate
• BZ - 856293 - Nameserver does not have a corresponding A/AAAA record while creating new dns zone
• BZ - 856294 - Instructions to uninstall are unclear
• BZ - 859968 - IPA browser configuration won't work on Firefox >= 15
• BZ - 860683 - group-mod should not be allowed to rename or modify admins account
• BZ - 864533 - Forbidden access to IPA published CRL
• BZ - 866572 - ipa-adtrust-install checks for /usr/bin/smbpasswd, which is not required
• BZ - 866966 - httpd needs restart post ipa-adtrust-install
• BZ - 866977 - Inform user when ipa-upgradeconfig reports errors
• BZ - 866978 - ipa-server-install --setup-dns always installs reverse zone
• BZ - 867447 - ipa-adtrust-install does not reset all information when re-run
• BZ - 867676 - extdom plugin does not handle Posix UID and GID request
• BZ - 868956 - Adding dnsone using name-server and ipaddress, adds zone with incorrect data
• BZ - 869279 - Bad link to Web UI config page after session is expired
• BZ - 869616 - Issues when adding AD user as member of external group
• BZ - 869656 - Improve information on passsync user in man page, command help
• BZ - 869658 - It is not possible to disable forwarding on per-zone basics
• BZ - 869741 - Re-adding an existing entry in trust, does not throw exception.
• BZ - 870053 - Default SELinuxusermaporder needs to mapped with default selinux users list
• BZ - 870234 - CVE-2012-4546 ipa: servers do not publish correct CRLs
• BZ - 870446 - multi operations with attribute manipulation not returning error
• BZ - 872707 - ipa-server dependency on krb5-server is not adequate
• BZ - 874935 - ipa-server installation fails to find A/AAAA record for IPA hostname
• BZ - 875261 - IPA WebUI login for AD Trusted User fails
• BZ - 877324 - Missing Option to add SSH Public Key in Web UI after upgrade
• BZ - 877434 - not exact error message show up when adding an AD member to an external type group while the time difference between ad and ipa is too great
• BZ - 878288 - IPA users are not available after ipa-server-install because sssd not running
• BZ - 878462 - Special case NFS related ticket to avoid attaching MS-PACs
• BZ - 878480 - Lookup user SIDs in external groups
• BZ - 878485 - ipa trust-add prints misleading information about required DNS setting
• BZ - 878969 - Write replacement for python-crypto
• BZ - 880655 - Regression in default value of group type in user group adder dialog
• BZ - 888124 - ipa install does not enable sssd start on boot
• BZ - 888524 - ipa delegation-find --group option returns internal error
• BZ - 888915 - cookie library does not parse nor generate expires attribute correctly when locale is not english
• BZ - 888956 - Cannot install an IPA Replica server with PKI-CA/Dogtag from a master with a large CRL
• BZ - 889583 - ipa server install failing when realm differs from domain
• BZ - 891980 - Make the root CA lifetime at least 15 years
• BZ - 893187 - Installing IPA with a single realm component sometimes fails
• BZ - 893722 - ipa-server upgrade ERROR Cannot move CRL file to new directory
• BZ - 893827 - ipa permission-find using valid targetgroup throws internal error
• BZ - 894090 - Internal Server Error during ldap Migration
• BZ - 894131 - ipa-replica-install fails to add idnssoaserial for a new zone
• BZ - 894143 - ipa-replica-prepare fails when reverse zone does not have SOA serial data
• BZ - 895298 - IPA upgrade error restarting named when dirsrv off before upgrade
• BZ - 895561 - IPA install in pure IPv6 environment fails with "Can't contact LDAP server" error
• BZ - 903758 - upgrading IPA from 2.2 to 3.0 sees certmonger errors
• BZ - 905594 - Unable to install ipa-server-trust-ad pkg on 32-bit platform

CVEs

• CVE-2012-4546

References

• https://access.redhat.com/security/updates/classification/#low
• https://access.redhat.com/knowledge/solutions/295843
• https://access.redhat.com/knowledge/docs/en-US/Red_Hat_Enterprise_Linux/6/html/6.4_Technical_Notes/ipa.html