PT-2009-1260 · Red Hat · Dogtag Certificate System+1

Publicado 2009-01-30 · Atualizado 2017-08-08 · CVE-2008-5082

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Média

Vetor base

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Red Hat Certificate System versions 7.1 through 7.3 Dogtag Certificate System version 1.0

Description The issue concerns the verifyProof function in the Token Processing System component, which returns successfully even when token enrollment did not use the hardware key. This allows remote authenticated users with enrollment privileges to bypass intended authentication policies by performing enrollment with a software key.

Recommendations For Red Hat Certificate System versions 7.1 through 7.3, consider disabling the verifyProof function in the Token Processing System component until a patch is available. For Dogtag Certificate System version 1.0, restrict access to the enrollment process to minimize the risk of exploitation.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2008-5082

RHSA-2009:0007

Produtos afetados

Dogtag Certificate System

Red Hat Certificate System

Referências · 7

• https://exchange.xforce.ibmcloud.com/vulnerabilities/48331 · Nota
• https://rhn.redhat.com/errata/RHSA-2009-0007.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-5082 · Nota de Segurança
• http://secunia.com/advisories/33693 · Aviso do Fabricante
• http://vupen.com/english/advisories/2009/0145 · Nota
• http://securityfocus.com/bid/33508 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=475998 · Nota