PT-2008-3224 · Red Hat+1 · Red Hat Certificate System+1

Published 2008-07-07 · Updated 2023-02-13 · CVE-2008-1676

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Red Hat Certificate System versions 7.1 through 7.3 Netscape Certificate Management System version 6.x

Description The issue allows remote attackers to bypass intended restrictions and conduct man-in-the-middle attacks by submitting a certificate signing request (CSR) and using the resulting certificate, due to the failure to recognize Certificate Authority profile constraints on Extensions.

Recommendations For Red Hat Certificate System versions 7.1 through 7.3, consider restricting access to certificate signing requests until a fix is available. For Netscape Certificate Management System version 6.x, avoid using the affected Certificate Authority profile constraints on Extensions until the issue is resolved. As a temporary workaround, consider disabling the use of certificate signing requests in the affected systems until a patch is available.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2008-1676

RHSA-2008:0500

RHSA-2008:0577

Affected Products

Netscape Certificate Management System

Red Hat Certificate System

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2008-1676 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=445227 · Note
• http://securityfocus.com/bid/30062 · Note
• http://rhn.redhat.com/errata/RHSA-2008-0500.html · Patch, Vendor Advisory
• http://securitytracker.com/id?1020427 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43573 · Note
• http://secunia.com/advisories/30929 · Note
• http://rhn.redhat.com/errata/RHSA-2008-0577.html · Patch, Vendor Advisory