CVE-2016-5404

What it actually does

Missing permission check in the cert_revoke command allows any user holding only the retrieve certificate permission to invoke revocation on arbitrary certificates.

Why it matters to the business

Organizations lose control over certificate lifecycle, enabling disruption of services that rely on valid certificates and forcing emergency re-issuance or downtime.

How an attack unfolds

An authenticated user with retrieve-certificate rights crafts a cert_revoke request for a target certificate; because the required revoke permission is never enforced, the server accepts and processes the revocation, immediately invalidating the certificate for all relying parties.

How to fix it

Upgrade FreeIPA to a version that enforces the revoke-certificate permission on the cert_revoke command; restrict retrieve-certificate rights to the minimum set of accounts that truly require them; monitor certificate revocation logs for unexpected entries.

How to confirm the fix worked

Review the source or package changelog for the permission check addition; attempt a revocation with a test account that possesses only retrieve-certificate rights and confirm the operation is now denied; inspect audit logs for the presence of the permission check.

Typical attack path

1. Obtain valid authentication credentials to the FreeIPA instance
2. Acquire retrieve-certificate permission through normal role assignment or misconfiguration
3. Submit a crafted cert_revoke command specifying an arbitrary certificate serial or subject
4. Observe successful revocation without any permission error
5. Leverage resulting service disruption or conduct follow-on attacks against systems that now lack valid certificates

How to detect it

Search FreeIPA audit and command logs for cert_revoke invocations performed by accounts lacking the revoke-certificate permission; correlate with certificate status changes that lack corresponding administrative approval.

What your security team should do

• Prioritize patching all FreeIPA servers to a version containing the permission enforcement fix
• Audit current role assignments and remove retrieve-certificate grants from accounts that do not also hold revoke-certificate rights
• Enable and retain detailed audit logging for certificate operations
• Establish a process to verify certificate validity status after any administrative change