PT-2007-6104 · Red Hat · Red Hat Certificate System Certificate Server

Published 2007-11-06 · Updated 2011-03-08 · CVE-2007-4994

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Red Hat Certificate System (RHCS) Certificate Server version 7.2

Description The issue is related to the handling of new revocations during the generation of a Certificate Revocation List (CRL). This might cause delays in adding certain revoked certificates to the CRL, potentially allowing users with revoked certificates to bypass the intended CRL.

Recommendations For Red Hat Certificate System (RHCS) Certificate Server version 7.2, consider updating the CRL generation process to properly handle new revocations in real-time to prevent revoked certificates from being used. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2007-4994

RHSA-2007:0934

RHSA-2008:0566

Affected Products

Red Hat Certificate System Certificate Server

References · 9

• https://rhn.redhat.com/errata/RHSA-2008-0566.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2007-0934.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-4994 · Security Note
• http://vupen.com/english/advisories/2007/3406 · Note
• http://securityfocus.com/bid/26377 · Note
• http://securitytracker.com/id?1020532 · Note
• http://osvdb.org/40440 · Note
• http://vupen.com/english/advisories/2007/3405 · Note
• http://secunia.com/advisories/27557 · Note