PT-2010-5130 · Red Hat · Dogtag Certificate System+1

Tomas Hoger · Published 2010-11-17 · Updated 2010-11-18 · CVE-2010-3869

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Red Hat Certificate System (RHCS) versions 7.3 and 8 Dogtag Certificate System (affected versions not specified)

Description The issue allows remote authenticated users to generate an arbitrary number of certificates by replaying a single SCEP one-time PIN.

Recommendations For Red Hat Certificate System (RHCS) versions 7.3 and 8, consider restricting access to the SCEP functionality until a fix is available. For Dogtag Certificate System, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2010-3869

RHSA-2010:0837

RHSA-2010:0838

Affected Products

Dogtag Certificate System

Red Hat Certificate System

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2010-3869 · Security Note
• https://fedorahosted.org/pki/changeset/1246 · Patch
• https://rhn.redhat.com/errata/RHSA-2010-0838.html · Vendor Advisory
• http://secunia.com/advisories/42181 · Vendor Advisory
• https://rhn.redhat.com/errata/RHSA-2010-0837.html · Vendor Advisory
• http://osvdb.org/69148 · Note
• http://securitytracker.com/id?1024697 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=648883 · Note