Red Hat Identity Management 'ipa-client' Cross Site Request Forgery Vulnerability

Bugtraq ID:	50930
Class:	Design Error
CVE:	CVE-2011-3636
Remote:	Yes
Local:	No
Published:	Dec 06 2011 12:00AM
Updated:	Dec 06 2011 12:00AM
Credit:	Red Hat
Vulnerable:	Red Hat Enterprise Linux Workstation 6 Red Hat Enterprise Linux Server 6 Red Hat Enterprise Linux HPC Node Optional 6 Red Hat Enterprise Linux HPC Node 6 Red Hat Enterprise Linux Desktop Optional 6 Red Hat Enterprise Linux Desktop 6
Not Vulnerable:

Red Hat Identity Management 'ipa-client' Cross Site Request Forgery Vulnerability

Red Hat Identity Management is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain actions in the context of an authorized user's session and gain unauthorized access to the affected application; other attacks are also possible.

Red Hat Identity Management 'ipa-client' Cross Site Request Forgery Vulnerability

To exploit this issue, an attacker must entice an unsuspecting victim into visiting a malicious webpage.

Red Hat Identity Management 'ipa-client' Cross Site Request Forgery Vulnerability

Solution:
Updates are available. Please see the references for more information.

Red Hat Identity Management 'ipa-client' Cross Site Request Forgery Vulnerability

References:

• Red Hat Homepage (Red Hat)
  
• RHSA-2011:1533-4 ipa security and bug fix update (Red Hat)