PT-2012-4666 · Red Hat · Dogtag Certificate System+1

Tomas Hoger · Publicado 2012-08-13 · Atualizado 2017-08-29 · CVE-2012-3367

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Red Hat Certificate System (RHCS) versions prior to 8.1.1 Dogtag Certificate System (affected versions not specified)

Description The issue concerns the improper checking of certificate revocation requests made through the web interface. This allows remote attackers with permissions to revoke end entity certificates to revoke the Certificate Authority (CA) certificate.

Recommendations For Red Hat Certificate System (RHCS) versions prior to 8.1.1, update to version 8.1.1 or later to resolve the issue. For Dogtag Certificate System, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2012-3367

RHSA-2012:1103

Produtos afetados

Dogtag Certificate System

Red Hat Certificate System

Referências · 9

• 🔥 https://fedorahosted.org/pki/changeset/2430 · Exploit
• http://securityfocus.com/bid/54608 · Nota
• http://secunia.com/advisories/50013 · Aviso do Fabricante
• http://osvdb.org/84098 · Nota
• http://rhn.redhat.com/errata/RHSA-2012-1103.html · Aviso do Fabricante
• http://securitytracker.com/id?1027284 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=836268 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/77102 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-3367 · Nota de Segurança