RHSA-2015:0442 - Security Advisory

Topic

Updated ipa packages that fix two security issues, several bugs, and add
various enhancements are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.

Description

Red Hat Identity Management (IdM) is a centralized authentication, identity
management, and authorization solution for both traditional and cloud-based
enterprise environments.

Two cross-site scripting (XSS) flaws were found in jQuery, which impacted the
Identity Management web administrative interface, and could allow an
authenticated user to inject arbitrary HTML or web script into the interface.
(CVE-2010-5312, CVE-2012-6662)

Note: The IdM version provided by this update no longer uses jQuery.

This update adds several enhancements that are described in more detail in the
Red Hat Enterprise Linux 7.1 Release Notes, linked to in the References section,
including:

• Added the "ipa-cacert-manage" command, which renews the Certification

Authority (CA) file. (BZ#886645)

• Added the ID Views feature. (BZ#891984)
• IdM now supports using one-time password (OTP) authentication and allows

gradual migration from proprietary OTP solutions to the IdM OTP solution.
(BZ#919228)

• Added the "ipa-backup" and "ipa-restore" commands to allow manual backups.

(BZ#951581)

• Added a solution for regulating access permissions to specific sections of the

IdM server. (BZ#976382)

This update also fixes several bugs, including:

• Previously, when IdM servers were configured to require the Transport Layer

Security protocol version 1.1 (TLSv1.1) or later in the httpd server, the "ipa"
command-line utility failed. With this update, running "ipa" works as expected
with TLSv1.1 or later. (BZ#1156466)

In addition, this update adds multiple enhancements, including:

• The "ipa-getkeytab" utility can now optionally fetch existing keytabs from the

KDC. Previously, retrieving an existing keytab was not supported, as the only
option was to generate a new key. (BZ#1007367)

• You can now create and manage a "." root zone on IdM servers. DNS queries sent

to the IdM DNS server use this configured zone instead of the public zone.
(BZ#1056202)

• The IdM server web UI has been updated and is now based on the Patternfly

framework, offering better responsiveness. (BZ#1108212)

• A new user attribute now enables provisioning systems to add custom tags for

user objects. The tags can be used for automember rules or for additional local
interpretation. (BZ#1108229)

• This update adds a new DNS zone type to ensure that forward and master zones

are better separated. As a result, the IdM DNS interface complies with the
forward zone semantics in BIND. (BZ#1114013)

• This update adds a set of Apache modules that external applications can use to

achieve tighter interaction with IdM beyond simple authentication. (BZ#1107555)

• IdM supports configuring automember rules for automated assignment of users or

hosts in respective groups according to their characteristics, such as the
"userClass" or "departmentNumber" attributes. Previously, the rules could be
applied only to new entries. This update allows applying the rules also to
existing users or hosts. (BZ#1108226)

• The extdom plug-in translates Security Identifiers (SIDs) of Active Directory

(AD) users and groups to names and POSIX IDs. With this update, extdom returns
the full member list for groups and the full list of group memberships for a
user, the GECOS field, the home directory, as well as the login shell of a user.
Also, an optional list of key-value pairs contains the SID of the requested
object if the SID is available. (BZ#1030699)

All ipa users are advised to upgrade to these updated packages, which contain
backported patches to correct these issues and add these enhancements.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.3 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.3 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.4 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.3 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux Server from RHUI 7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.5 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.4 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.3 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux Server - AUS 7.3 x86_64
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - TUS 7.3 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.3 x86_64

Fixes

• BZ - 711693 - [RFE] Normal users should not be given privileges to view all sudorules and their details.
• BZ - 788645 - [RFE] Allow filter and subtree to be added in same permission
• BZ - 815828 - Rename DNS permissions to use mixed-case
• BZ - 817909 - error indicates a different reason when ipa permission-mod fails to modify attrs
• BZ - 854335 - Unable to update "remove automount keys" - it has filter and subtree specified
• BZ - 887988 - [RFE] Expose the krbPrincipalExpiration attribute for editing in the IPA CLI / WEBUI
• BZ - 891984 - [RFE] ID Views: Support migration from the sync solution to the trust solution
• BZ - 893850 - Unable to update permissions for "Add Automount Keys"
• BZ - 921655 - fix UI CSS to support RH branding
• BZ - 922749 - IPA Navigation links overlaped or unclickable
• BZ - 924008 - Unknown binary attributes can cause migration to fail
• BZ - 924395 - [RFE] ipa-client-install should configure sudo automatically
• BZ - 951581 - [RFE] Backup & Restore mechanism
• BZ - 970618 - [RFE] pac-type change must be effective immediately without kdc restart
• BZ - 971061 - Localization not working even for languages that are localized
• BZ - 975456 - [RFE] add option to ipa-client-install to configure automount
• BZ - 985234 - ipa-client-install --uninstall starts nscd service
• BZ - 1027712 - "username" field in IPA webUI login page should be mandatory
• BZ - 1027713 - There is no version information on IPA WebUI
• BZ - 1030699 - [RFE] Support initgroups for unauthenticated AD users
• BZ - 1031111 - ipa-client: add root CA to trust anchors if not already available
• BZ - 1033357 - ipactl can not restart ipa services if current status is "stopped"
• BZ - 1035286 - [WebUI] Realm domain is not providing proper error message
• BZ - 1048934 - [WebUI] Retry and Cancel dialogs do not support 'confirmation by Enter'
• BZ - 1048956 - [WebUI] "OK" button is not focused on "Operations Error" dialog, once we opened "show details"
• BZ - 1056202 - [RFE] Support DNS root zone
• BZ - 1058780 - Missing checks during ipa idrange-add
• BZ - 1060349 - IPA: Unable to add host when ipv6 address already exits
• BZ - 1061772 - [WebUI] Maximum serial number search accepts negative inputs and lists wrong search results.
• BZ - 1072502 - running ipa-server-install --setup-dns results in a crash
• BZ - 1075129 - bogus time estimates shown for configuration of various component in replica installation
• BZ - 1077734 - [WebUI] select all checkbox remains selected after operation
• BZ - 1080209 - IPA server does not allow sudo host network filters
• BZ - 1080532 - ipa-client-install --uninstall crash on a freshly installed machine joined to IPA via reamd and anaconda
• BZ - 1081626 - When certmonger is still tracking cert in ipa, uninstall fails but error does not indicate this
• BZ - 1084609 - [RFE] RHEL7 support for ipa-admintools on other architectures
• BZ - 1099811 - Apache crashes when replica is restarted when installing
• BZ - 1107555 - [RFE] Provide a stack of apache modules for any applications to consume
• BZ - 1108195 - MOD command returns duplicate memberships
• BZ - 1108201 - cannot create dns zone when name has consecutive dash characters
• BZ - 1108202 - dnsrecord-* with absolute target gives error
• BZ - 1108203 - [RFE] Add EmployeeID in the Web UI and command name
• BZ - 1108204 - PTR record cannot be added from UI, if user added zone without last '.'
• BZ - 1108205 - Replica installation dies if /etc/resolv.conf is not writeable
• BZ - 1108206 - sshd should run at least once before ipa-client-install
• BZ - 1108207 - [WebUI] When adding a condition to an automember rule, expression field should be required
• BZ - 1108208 - The Synchronizing time with KDC... message looks strange between login and password prompts
• BZ - 1108212 - [RFE] Adopt Patternfly/RCUE open interface project for the Web UI
• BZ - 1108213 - Installers should explicitly specify auth mechanism when calling ldapmodify
• BZ - 1108214 - ipa-replica-install: DNS check is between "host already exists" message and exit
• BZ - 1108215 - Make Read replication agreements permission less more targeted
• BZ - 1108216 - Unexpected error when providing incorrect password to ipa-ldap-updater
• BZ - 1108220 - Broken Firefox configuration files in freeipa-client package
• BZ - 1108222 - SSH widget doesn't honor a lack of write right
• BZ - 1108224 - Replace ntpdate calls with ntpd
• BZ - 1108225 - ipadb.so could get tripped up by DAL changes to support keyless principals
• BZ - 1108226 - [RFE] Use automember for hosts after the host is added
• BZ - 1108228 - Add UI for the new user and host userClass attribute
• BZ - 1108229 - [RFE] Better integration with the external provisioning systems - users
• BZ - 1108230 - Should not display ports to open when password is incorrect during ipa-client-install.
• BZ - 1108231 - ipa-join usage instructions are incorrect
• BZ - 1108232 - [RFE] ipa migrate-ds should have an argument to specify cert to use for DS connection
• BZ - 1108233 - [RFE] ipa dnsrecord-add should allow internationalized names
• BZ - 1108234 - [WebUI] it is not clear which row a value belongs to
• BZ - 1108235 - xmlrpc system commands do not work
• BZ - 1108236 - Name is blank in error message for duplicate automember rule
• BZ - 1108237 - [RFE] Enhance input validation for filters in access control
• BZ - 1109726 - Rebase IPA to 4.1
• BZ - 1112603 - Internal Error: `ipa sudorule-mod rule --order=`
• BZ - 1112605 - [RFE] Add support for SubjectAltNames (SAN) to IPA service certificates
• BZ - 1112691 - ipa-server-install break sshd
• BZ - 1113918 - Setting a sudo category to all doesn't check to see if rules already exist
• BZ - 1113919 - Let deny commands be added to sudo rule with cmdcatetory=ALL
• BZ - 1113920 - Sudo runasgroup entry not generated by the sudo compat tree
• BZ - 1114013 - [RFE] Separate master and forward DNS zones
• BZ - 1115048 - Description attribute should not be required
• BZ - 1115616 - [RFE] Allow unlocking user in Web UI
• BZ - 1126989 - ipa-client-install creates configuration file with deprecated values
• BZ - 1128380 - Failure when installing on dual stacked system with external ca
• BZ - 1129558 - Windows Server 2012 CA does not accept CSR generated by IdM External CA installation
• BZ - 1129730 - CA-less installation fails when the CA cert has an empty subject
• BZ - 1131049 - Update SSL ciphers configured in 389-ds-base
• BZ - 1131187 - ipa-ldap-upgrade should restore Directory Server settings when upgrade fails
• BZ - 1131877 - Registering one IPA server with the browser removes entries for another
• BZ - 1133966 - ipa trust-add cmd should be interactive
• BZ - 1138773 - Internal error received for blank password with --trust-secret
• BZ - 1138775 - Password migration is broken
• BZ - 1138777 - Renewal with no master CA
• BZ - 1138791 - Prohibit setting --rid-base for ranges of ipa-trust-ad-posix type
• BZ - 1138792 - Disable unsupported ID range types
• BZ - 1138795 - DS returns limited RootDSE
• BZ - 1138798 - Add support for bounce_url to /ipa/ui/reset_password.html
• BZ - 1138803 - Do not store host certificate in shared NSS database /etc/pki/nssdb
• BZ - 1142088 - ipa-server-install searches CA under different hostname
• BZ - 1142789 - host-del command does not accept --continue
• BZ - 1147679 - ipa man page incorrectly indicates how to add users
• BZ - 1149124 - group-add doesn't accept gid parameter
• BZ - 1156466 - POODLE: force using safe ciphers (non-SSLv3) in IPA client and server
• BZ - 1159011 - Trust setting not restored for CA cert with ipa-restore command
• BZ - 1159330 - RHEL7.1 ipa-server-install --uninstall Could not set SELinux booleans for httpd
• BZ - 1159816 - ignoring user attributes in migrate-ds does not work if uppercase characters are returned by ldap
• BZ - 1160756 - Investigate & fix Coverity defects in IPA DS/KDC plugins
• BZ - 1160758 - Tests: host-del returns DatabaseError
• BZ - 1161128 - Upgrade 3.3.5 to 4.1 failed
• BZ - 1161129 - ipactl stop should stop dirsrv last
• BZ - 1161131 - Deadlock in schema compat plugin
• BZ - 1162340 - ipa-server-install fails when restarting named
• BZ - 1163498 - Renewing the CA signing certificate does not extend its validity period end
• BZ - 1163849 - error message which is not understandable when IDNA2003 characters are present in --zonemgr (--zonemgr=T??ko@redhat.com)
• BZ - 1164859 - Traceback when adding zone with long name
• BZ - 1164896 - RHEL7.1 IPA server httpd avc denials after upgrade
• BZ - 1166041 - CVE-2010-5312 jquery-ui: XSS vulnerability in jQuery.ui.dialog title option
• BZ - 1166064 - CVE-2012-6662 jquery-ui: XSS vulnerability in default content in Tooltip widget
• BZ - 1166641 - ipa-otp-lasttoken loads all user's tokens on every mod/del
• BZ - 1166931 - RHEL7.1 ipa automatic CA cert renewal stuck in submitting state
• BZ - 1167196 - schema update on RHEL-6.6 using latest copy-schema-to-ca.py from RHEL-7.1 build fails
• BZ - 1167270 - Tracebacks with latest build for --zonemgr cli option
• BZ - 1167964 - RHEL7.1 ipa replica unable to replicate to rhel6 master
• BZ - 1168214 - [WebUI] Not able to unprovisioning service in IPA 4.1
• BZ - 1168376 - Clean up debug log for trust-add
• BZ - 1168916 - Extend host-show to add the view attribute in set of default attributes
• BZ - 1169591 - RHEL7.1 ipa-cacert-manage renewed certificate from MS ADCS not compatible
• BZ - 1169867 - Winsync: Setup is broken due to incorrect import of certificate
• BZ - 1170003 - RHEL7.1 ipa-cacert-manage cannot change external to self-signed ca cert
• BZ - 1170695 - krb5kdc crash in ldap_pvt_search
• BZ - 1171089 - webui: increase notification duration
• BZ - 1172578 - CLI doesn't show SSHFP records with SHA256 added via nsupdate (regression)
• BZ - 1172598 - Access is not rejected for disabled domain
• BZ - 1173207 - IPA certs fail to autorenew simultaneouly
• BZ - 1175277 - Data replication not working as expected after data restore from full backup
• BZ - 1175287 - No error message thrown on restore(full kind) on replica from full backup taken on master
• BZ - 1175326 - ipa-restore proceed even IPA not configured
• BZ - 1175384 - DNS zones are not migrated into forward zones if 4.0+ replica is added
• BZ - 1176034 - More validation required on ipa-restore's options
• BZ - 1176995 - IPA replica missing data after master upgraded
• BZ - 1177133 - When migrating warn user if compat is enabled
• BZ - 1178128 - IPA externally signed CA cert expiration warning missing from log
• BZ - 1181010 - ipa-replica-manage list does not list synced domain
• BZ - 1181093 - PassSync does not sync passwords due to missing ACIs
• BZ - 1181767 - ipa-upgradeconfig fails in CA-less installs
• BZ - 1183279 - ipa-replica-manage disconnect fails without password
• BZ - 1184149 - DUA profile not available anonymously
• BZ - 1185410 - idoverrideuser-add option --sshpubkey does not work
• BZ - 1186396 - ipa-restore crashes if replica is unreachable
• BZ - 1186398 - Wrong directories created on full restore
• BZ - 1187342 - Login ignores global OTP enablement
• BZ - 1187540 - Full set of objectclass not available post group detach.

CVEs

• CVE-2010-5312
• CVE-2012-6662

References

• https://access.redhat.com/security/updates/classification/#moderate
• https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.1_Release_Notes/index.html