CVE-2008-3274 Information disclosure in n/a
Remote attackers can obtain the Kerberos master key via anonymous LDAP queries due to insecure default ACLs, compromising identity management security.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2008-3274?
CVE-2008-3274 is a medium-severity vulnerability in n/a, published on 12 Sep 2008. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The default configuration of Red Hat Enterprise IPA 1.0.0 and FreeIPA before 1.1.1 places ldap:///anyone on the read ACL for the krbMKey attribute, which allows remote attackers to obtain the Kerberos master key via an anonymous LDAP query.
Weakness: CWE-200
Which versions are affected by CVE-2008-3274?
It affects 2 products.
Linux distribution packages (7)
ipa Red Hat:enterprise_ipa:1.0 | All versions | 0:1.0.0-23.el5ipa |
ipa-admintools Red Hat:enterprise_ipa:1.0 | All versions | 0:1.0.0-23.el5ipa |
ipa-client Red Hat:enterprise_ipa:1.0 | All versions | 0:1.0.0-23.el5ipa |
ipa-debuginfo Red Hat:enterprise_ipa:1.0 | All versions | 0:1.0.0-23.el5ipa |
ipa-python Red Hat:enterprise_ipa:1.0 | All versions | 0:1.0.0-23.el5ipa |
ipa-server Red Hat:enterprise_ipa:1.0 | All versions | 0:1.0.0-23.el5ipa |
ipa-server-selinux Red Hat:enterprise_ipa:1.0 | All versions | 0:1.0.0-23.el5ipa |
Products include Redhat Enterprise Ipa, Redhat Freeipa.
How do I fix CVE-2008-3274?
Apply the vendor's patch.
Is CVE-2008-3274 being exploited?
There is no known exploitation of CVE-2008-3274 in the wild and no public exploit code.
Sources
Also known as GHSA-8w34-c24h-wvp3, RHSA-2008:0860.