PT-2004-1235 · Openca · Openca

Alexandru Matei · Published 2004-02-17 · Updated 2017-10-10 · CVE-2004-0004

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenCA versions 0.9.1.6 and earlier

Description The issue arises from the libCheckSignature function in crypto-utils.lib, which only compares the serial of the signer's certificate and the one in the database. This comparison can lead to OpenCA incorrectly accepting a signature if the certificate's chain is trusted by OpenCA's chain directory, allowing remote attackers to spoof requests from other users.

Recommendations For OpenCA versions 0.9.1.6 and earlier, consider restricting access to the libCheckSignature function until a patch is available, or apply configuration changes to enhance certificate chain validation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2004-0004

Affected Products

Openca

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2004-0004 · Security Note
• http://openca.org/news/CAN-2004-0004.txt · Vendor Advisory
• http://securityfocus.com/bid/9435 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=107427313700554&w=2 · Note
• http://kb.cert.org/vuls/id/336446 · Note
• http://osvdb.org/3615 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/14847 · Note