PT-2006-5734 · Rsa · Rsa Keon Certificate Authority (Keonca) Manager

Published 2006-09-26 · Updated 2018-10-17 · CVE-2006-4991

Positive Technologies (AI Summary)

CVSS v2.0

3.6

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions RSA Keon Certificate Authority (KeonCA) Manager versions 6.5.1 through 6.6

Description The issue allows privileged local users to hide malicious Certificate Authority (CA) activities by modifying CA auditor logs without detection. This can be achieved in two ways: (1) by modifying or deleting a LOG BLOCK and its signature from the XML log, which is not detected by the integrity check function, or (2) by modifying entries in the live log file, which is only signed during rotation.

Recommendations For RSA Keon Certificate Authority (KeonCA) Manager versions 6.5.1 through 6.6, consider implementing additional logging and monitoring measures to detect potential log modifications. As a temporary workaround, restrict access to the log files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2006-4991

Affected Products

Rsa Keon Certificate Authority (Keonca) Manager

References · 6

• http://lists.grok.org.uk/pipermail/full-disclosure/2006-September/049592.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-4991 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29068 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29065 · Note
• http://securityfocus.com/bid/20136 · Note
• http://securityfocus.com/archive/1/446742/100/0/threaded · Note