← CVE Intelligence

CVE-2024-3183

Freeipa: user can obtain a hash of the passwords of all domain users and perform offline brute force PUBLISHED

Description (CNA)

A vulnerability was found in FreeIPA in a way when a Kerberos TGS-REQ is encrypted using the client’s session key. This key is different for each new session, which protects it from brute force attacks. However, the ticket it contains is encrypted using the target principal key directly. For user principals, this key is a hash of a public per-principal randomly-generated salt and the user’s password. If a principal is compromised it means the attacker would be able to retrieve tickets encrypted to any principal, all of them being encrypted by their own key directly. By taking these tickets and salts offline, the attacker could run brute force attacks to find character strings able to decrypt tickets when combined to a principal salt (i.e. find the principal’s password).

Affected (CNA)

Vendor / productVersions
Not supplied / Not suppliedunaffected 4.12.1
Red Hat / Red Hat Enterprise Linux 7unaffected 0:4.6.8-5.el7_9.17 before *
Red Hat / Red Hat Enterprise Linux 8unaffected 8100020240528133707.823393f5 before *
Red Hat / Red Hat Enterprise Linux 8.2 Advanced Update Supportunaffected 8020020240530191103.792f4060 before *
Red Hat / Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Supportunaffected 8040020240528055121.5b01ab7e before *
Red Hat / Red Hat Enterprise Linux 8.4 Telecommunications Update Serviceunaffected 8040020240528055121.5b01ab7e before *
Red Hat / Red Hat Enterprise Linux 8.4 Update Services for SAP Solutionsunaffected 8040020240528055121.5b01ab7e before *
Red Hat / Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportunaffected 8060020240530061719.ada582f1 before *
Red Hat / Red Hat Enterprise Linux 8.6 Telecommunications Update Serviceunaffected 8060020240530061719.ada582f1 before *
Red Hat / Red Hat Enterprise Linux 8.6 Update Services for SAP Solutionsunaffected 8060020240530061719.ada582f1 before *
Red Hat / Red Hat Enterprise Linux 8.8 Extended Update Supportunaffected 8080020240530051744.b0a6ceea before *
Red Hat / Red Hat Enterprise Linux 9unaffected 0:4.11.0-15.el9_4 before *
Red Hat / Red Hat Enterprise Linux 9.0 Extended Update Supportunaffected 0:4.9.8-11.el9_0.3 before *
Red Hat / Red Hat Enterprise Linux 9.2 Extended Update Supportunaffected 0:4.10.1-12.el9_2.2 before *
Red Hat / Red Hat Enterprise Linux 10unaffected

CWE

CWE-916

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.