PT-2004-1235 · Openca · Openca

Alexandru Matei · Publicado 2004-02-17 · Atualizado 2017-10-10 · CVE-2004-0004

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenCA versions 0.9.1.6 and earlier

Description The issue arises from the libCheckSignature function in crypto-utils.lib, which only compares the serial of the signer's certificate and the one in the database. This comparison can lead to OpenCA incorrectly accepting a signature if the certificate's chain is trusted by OpenCA's chain directory, allowing remote attackers to spoof requests from other users.

Recommendations For OpenCA versions 0.9.1.6 and earlier, consider restricting access to the libCheckSignature function until a patch is available, or apply configuration changes to enhance certificate chain validation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2004-0004

Produtos afetados

Openca

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2004-0004 · Nota de Segurança
• http://openca.org/news/CAN-2004-0004.txt · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=107427313700554&w=2 · Nota
• http://kb.cert.org/vuls/id/336446 · Nota
• http://osvdb.org/3615 · Nota
• http://securityfocus.com/bid/9435 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/14847 · Nota