PT-2007-6104 · Red Hat · Red Hat Certificate System Certificate Server

Publicado 2007-11-06 · Atualizado 2011-03-08 · CVE-2007-4994

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Red Hat Certificate System (RHCS) Certificate Server version 7.2

Description The issue is related to the handling of new revocations during the generation of a Certificate Revocation List (CRL). This might cause delays in adding certain revoked certificates to the CRL, potentially allowing users with revoked certificates to bypass the intended CRL.

Recommendations For Red Hat Certificate System (RHCS) Certificate Server version 7.2, consider updating the CRL generation process to properly handle new revocations in real-time to prevent revoked certificates from being used. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2007-4994

RHSA-2007:0934

RHSA-2008:0566

Produtos afetados

Red Hat Certificate System Certificate Server

Referências · 9

• http://vupen.com/english/advisories/2007/3406 · Nota
• http://securityfocus.com/bid/26377 · Nota
• http://securitytracker.com/id?1020532 · Nota
• https://rhn.redhat.com/errata/RHSA-2008-0566.html · Aviso do Fabricante
• http://osvdb.org/40440 · Nota
• http://redhat.com/support/errata/RHSA-2007-0934.html · Aviso do Fabricante
• http://vupen.com/english/advisories/2007/3405 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-4994 · Nota de Segurança
• http://secunia.com/advisories/27557 · Nota