Lucene search

[email protected]CVE-2008-1676

HistoryJul 07, 2008 - 11:41 p.m.

CVE-2008-1676

2008-07-0723:41:00

CWE-255

[email protected]

web.nvd.nist.gov

red hat

pki

common framework

rhpki-common

certificate system

certificate server

rhcs

netscape

certificate management system

cve-2008-1676

security vulnerability

man-in-the-middle attack

nvd

6.9 Medium

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.009 Low

EPSS

Percentile

82.8%

JSON

Red Hat PKI Common Framework (rhpki-common) in Red Hat Certificate System (aka Certificate Server or RHCS) 7.1 through 7.3, and Netscape Certificate Management System 6.x, does not recognize Certificate Authority profile constraints on Extensions, which might allow remote attackers to bypass intended restrictions and conduct man-in-the-middle attacks by submitting a certificate signing request (CSR) and using the resulting certificate.

CPENameOperatorVersion
netscape:certificate_management_systemnetscape certificate management systemle6.2
netscape:certificate_management_systemnetscape certificate management systemeq6.0
netscape:certificate_management_systemnetscape certificate management systemeq6.01
netscape:certificate_management_systemnetscape certificate management systemeq6.1

CPE	Name	Operator	Version
netscape:certificate_management_system	netscape certificate management system	le	6.2
netscape:certificate_management_system	netscape certificate management system	eq	6.0
netscape:certificate_management_system	netscape certificate management system	eq	6.01
netscape:certificate_management_system	netscape certificate management system	eq	6.1

References

rhn.redhat.com/errata/RHSA-2008-0500.html

rhn.redhat.com/errata/RHSA-2008-0577.html

secunia.com/advisories/30929

www.securityfocus.com/bid/30062

www.securitytracker.com/id?1020427

bugzilla.redhat.com/show_bug.cgi?id=445227

exchange.xforce.ibmcloud.com/vulnerabilities/43573

6.9 Medium

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.009 Low

EPSS

Percentile

82.8%

JSON

Related for CVE-2008-1676

seebug1 cvelist1 prion1