9.1 CVE-2025-4404

Enriched by CISA
 

A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the `krbCanonicalName` for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a successful attack happens, the user can retrieve a Kerberos ticket in the name of this service, containing the admin@REALM credential. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.
https://nvd.nist.gov/vuln/detail/CVE-2025-4404

Categories

CWE-1220 : Insufficient Granularity of Access Control
The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets. A form hosting website only checks the session authentication status for a single form, making it possible to bypass authentication when there are multiple forms An operating system has an overly permission Access Control List onsome system files, including those related to user passwords

References


 

AFFECTED (from MITRE)

Vendor Product Versions
N/A N/A
  • < 4.12.4 [affected]
Red Hat Red Hat Enterprise Linux 10
  • 0:4.12.2-15.el10_0.1 < * [unaffected]
Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support
  • 0:4.6.8-5.el7_9.18 < * [unaffected]
Red Hat Red Hat Enterprise Linux 8
  • 8100020250603150652.143e9e98 < * [unaffected]
Red Hat Red Hat Enterprise Linux 8
  • 8100020250603134209.823393f5 < * [unaffected]
Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support
  • 8020020250609031831.50ea30f9 < * [unaffected]
Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support
  • 8020020250609030144.792f4060 < * [unaffected]
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  • 8040020250609101903.f153676a < * [unaffected]
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  • 8040020250609095221.5b01ab7e < * [unaffected]
Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  • 8060020250606060927.c1533a64 < * [unaffected]
Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  • 8060020250606060504.ada582f1 < * [unaffected]
Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service
  • 8060020250606060927.c1533a64 < * [unaffected]
Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service
  • 8060020250606060504.ada582f1 < * [unaffected]
Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  • 8060020250606060927.c1533a64 < * [unaffected]
Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  • 8060020250606060504.ada582f1 < * [unaffected]
Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
  • 8080020250604195510.e581a9e4 < * [unaffected]
Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
  • 8080020250604202433.b0a6ceea < * [unaffected]
Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  • 8080020250604195510.e581a9e4 < * [unaffected]
Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  • 8080020250604202433.b0a6ceea < * [unaffected]
Red Hat Red Hat Enterprise Linux 9
  • 0:4.12.2-14.el9_6.1 < * [unaffected]
Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
  • 0:4.9.8-11.el9_0.4 < * [unaffected]
Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  • 0:4.10.1-12.el9_2.4 < * [unaffected]
Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support
  • 0:4.11.0-15.el9_4.5 < * [unaffected]
Red Hat Red Hat Enterprise Linux 6
    Red Hat Red Hat In-Vehicle Operating System 1
      © 2022 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.

      CPE

      cpe start end

      REMEDIATION


      EXPLOITS

      Exploit-db.com

      id description date
      No known exploits

      POC Github

      Url
      No known exploits

      Other Nist (github, ...)

      Url
      No known exploits

      CAPEC

      Common Attack Pattern Enumerations and Classifications

      id description severity
      1 Accessing Functionality Not Properly Constrained by ACLs
      		High
      180 Exploiting Incorrectly Configured Access Control Security Levels
      		Medium

      MITRE

      Techniques

      id description
      T1574.010 Hijack Execution Flow: ServicesFile Permissions Weakness
      © 2022 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.

      Mitigations

      id description
      M1018 Limit privileges of user accounts and groups so that only authorized administrators can interact with service changes and service binary target path locations. Deny execution from user directories such as file download directories and temp directories where able.
      © 2022 The MITRE Corporation. Esta obra se reproduce y distribuye con el permiso de The MITRE Corporation.