rhsa-2009:0007
Vulnerability from csaf_redhat
Published
2009-01-29 09:31
Modified
2024-11-22 02:07
Summary
Red Hat Security Advisory: rhpki security and bug fix update

Notes

Topic
Updated rhpki-common packages that fix security issues are now available for Red Hat Certificate System 7.3. This update has been rated as having moderate security impact by the Red Hat Security Response Team.
Details
Red Hat Certificate System (RHCS) is an enterprise software system designed to manage enterprise Public Key Infrastructure (PKI) deployments. It was discovered that Red Hat Certificate System used insecure default file permissions on certain configuration files (for example, password.conf) that may contain authentication credentials. These credentials should only be accessible to administrative and service users. A local user could use this flaw to read Red Hat Certificate System configuration files containing sensitive information. (CVE-2008-2367) It was discovered that Red Hat Certificate System stored plain text passwords in multiple debug log files with insufficient access restrictions (for example, the UserDirEnrollment log and the RA wizard installer log). A local user could use this flaw to extract plain text passwords from the Red Hat Certificate System debug log files. (CVE-2008-2368) It was discovered that the Token Processing System (TPS) component of the Red Hat Certificate System did not properly verify the challenge response received during the enrollment of a new security token. An attacker with access to a blank token known to the TPS component and with privileges to perform new token enrollments could use this flaw to complete the enrollment procedure with a software-generated key instead of the key stored in the hardware token. (CVE-2008-5082) These updated packages fix the following bugs: * The end-entities enrollment pages have been updated to support the certenroll.dll library used on Microsoft Vista, so Internet Explorer can be used on to enroll certificates on Vista. * The password used by the LDAP publisher was improperly stored in the CA configuration. This essentially required that the LDAP publishing password had to be the same as the internal database (LDAP directory) password, or LDAP publishing would break. A new parameter was added to the CA CS.cfg file to define an LDAP publishing password parameter in the CA's password.conf file. * The secure ports used by subsystem interfaces — the administrative console, agent pages, and end-entities pages — are, by default, the same. It is possible with this errata to run those services on separate port, which provides additional protection by prohibiting agents and users from accessing the same TCP port and web services directory. * The certificate policies extension was not processed by CMSServlet. * Any IP Address defined in a certificate's SubjectAltName parameter was improperly coded as an 8-byte number, with the last 4 bytes trailing zeros (00 00 00 00). * The subject name uniqueness plug-in in the CA profiles, which enforces unique names for all active certificates, would reject a certificate request which reused a subject name even if the previous certificate had been revoked or expired. * The TPS dependences have been changed from MozLDAP5 to MozLDAP6. All users of Red Hat Certificate System 7.3 should upgrade to these updated packages, which resolves these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated rhpki-common packages that fix security issues are now available\nfor Red Hat Certificate System 7.3.\n\nThis update has been rated as having moderate security impact by the Red\nHat Security Response Team.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Certificate System (RHCS) is an enterprise software system designed\nto manage enterprise Public Key Infrastructure (PKI) deployments.\n\nIt was discovered that Red Hat Certificate System used insecure default\nfile permissions on certain configuration files (for example,\npassword.conf) that may contain authentication credentials. These \ncredentials should only be accessible to administrative and service users. \nA local user could use this flaw to read Red Hat Certificate System \nconfiguration files containing sensitive information. (CVE-2008-2367)\n\nIt was discovered that Red Hat Certificate System stored plain text\npasswords in multiple debug log files with insufficient access restrictions\n(for example, the UserDirEnrollment log and the RA wizard installer log). A\nlocal user could use this flaw to extract plain text passwords from the Red\nHat Certificate System debug log files. (CVE-2008-2368)\n\nIt was discovered that the Token Processing System (TPS) component of the\nRed Hat Certificate System did not properly verify the challenge response\nreceived during the enrollment of a new security token. An attacker with\naccess to a blank token known to the TPS component and with privileges to\nperform new token enrollments could use this flaw to complete the\nenrollment procedure with a software-generated key instead of the key\nstored in the hardware token. (CVE-2008-5082)\n\nThese updated packages fix the following bugs:\n\n* The end-entities enrollment pages have been updated to support the \ncertenroll.dll library used on Microsoft Vista, so Internet Explorer can \nbe used on to enroll certificates on Vista.\n\n* The password used by the LDAP publisher was improperly stored in the CA \nconfiguration. This essentially required that the LDAP publishing password\nhad to be the same as the internal database (LDAP directory) password, or \nLDAP publishing would break. A new parameter was added to the CA CS.cfg \nfile to define an LDAP publishing password parameter in the CA\u0027s \npassword.conf file.\n\n* The secure ports used by subsystem interfaces \u2014 the administrative \nconsole, agent pages, and end-entities pages \u2014 are, by default, the same. \nIt is possible with this errata to run those services on separate port,\nwhich provides additional protection by prohibiting agents and users from\naccessing the same TCP port and web services directory.\n\n* The certificate policies extension was not processed by CMSServlet.\n\n* Any IP Address defined in a certificate\u0027s SubjectAltName parameter was \nimproperly coded as an 8-byte number, with the last 4 bytes trailing zeros \n(00 00 00 00).\n\n* The subject name uniqueness plug-in in the CA profiles, which enforces \nunique names for all active certificates, would reject a certificate \nrequest which reused a subject name even if the previous certificate had \nbeen revoked or expired.\n\n* The TPS dependences have been changed from MozLDAP5 to MozLDAP6.\n\nAll users of Red Hat Certificate System 7.3 should upgrade to these updated\npackages, which resolves these issues.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2009:0007",
        "url": "https://access.redhat.com/errata/RHSA-2009:0007"
      },
      {
        "category": "external",
        "summary": "http://www.redhat.com/security/updates/classification/#moderate",
        "url": "http://www.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "451998",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=451998"
      },
      {
        "category": "external",
        "summary": "452000",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=452000"
      },
      {
        "category": "external",
        "summary": "459049",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=459049"
      },
      {
        "category": "external",
        "summary": "475998",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=475998"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_0007.json"
      }
    ],
    "title": "Red Hat Security Advisory: rhpki security and bug fix update",
    "tracking": {
      "current_release_date": "2024-11-22T02:07:36+00:00",
      "generator": {
        "date": "2024-11-22T02:07:36+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2009:0007",
      "initial_release_date": "2009-01-29T09:31:00+00:00",
      "revision_history": [
        {
          "date": "2009-01-29T09:31:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2009-01-29T04:31:12+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T02:07:36+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Certificate System 7.3 for 4AS",
                "product": {
                  "name": "Red Hat Certificate System 7.3 for 4AS",
                  "product_id": "4AS-CERT-7.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:certificate_system:7.3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Certificate System 7.3 for 4ES",
                "product": {
                  "name": "Red Hat Certificate System 7.3 for 4ES",
                  "product_id": "4ES-CERT-7.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:certificate_system:7.3"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Certificate System"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "pkisetup-0:7.3.0-14.el4.noarch",
                "product": {
                  "name": "pkisetup-0:7.3.0-14.el4.noarch",
                  "product_id": "pkisetup-0:7.3.0-14.el4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/pkisetup@7.3.0-14.el4?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhpki-ocsp-0:7.3.0-11.el4.noarch",
                "product": {
                  "name": "rhpki-ocsp-0:7.3.0-11.el4.noarch",
                  "product_id": "rhpki-ocsp-0:7.3.0-11.el4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rhpki-ocsp@7.3.0-11.el4?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhpki-ra-0:7.3.0-67.el4.noarch",
                "product": {
                  "name": "rhpki-ra-0:7.3.0-67.el4.noarch",
                  "product_id": "rhpki-ra-0:7.3.0-67.el4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rhpki-ra@7.3.0-67.el4?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhpki-ca-0:7.3.0-17.el4.noarch",
                "product": {
                  "name": "rhpki-ca-0:7.3.0-17.el4.noarch",
                  "product_id": "rhpki-ca-0:7.3.0-17.el4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rhpki-ca@7.3.0-17.el4?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhpki-tks-0:7.3.0-12.el4.noarch",
                "product": {
                  "name": "rhpki-tks-0:7.3.0-12.el4.noarch",
                  "product_id": "rhpki-tks-0:7.3.0-12.el4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rhpki-tks@7.3.0-12.el4?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhpki-util-0:7.3.0-20.el4.noarch",
                "product": {
                  "name": "rhpki-util-0:7.3.0-20.el4.noarch",
                  "product_id": "rhpki-util-0:7.3.0-20.el4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rhpki-util@7.3.0-20.el4?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhpki-kra-0:7.3.0-13.el4.noarch",
                "product": {
                  "name": "rhpki-kra-0:7.3.0-13.el4.noarch",
                  "product_id": "rhpki-kra-0:7.3.0-13.el4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rhpki-kra@7.3.0-13.el4?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhpki-common-0:7.3.0-40.el4.noarch",
                "product": {
                  "name": "rhpki-common-0:7.3.0-40.el4.noarch",
                  "product_id": "rhpki-common-0:7.3.0-40.el4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rhpki-common@7.3.0-40.el4?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhpki-tps-0:7.3.0-23.el4.x86_64",
                "product": {
                  "name": "rhpki-tps-0:7.3.0-23.el4.x86_64",
                  "product_id": "rhpki-tps-0:7.3.0-23.el4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rhpki-tps@7.3.0-23.el4?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhpki-tps-0:7.3.0-23.el4.i386",
                "product": {
                  "name": "rhpki-tps-0:7.3.0-23.el4.i386",
                  "product_id": "rhpki-tps-0:7.3.0-23.el4.i386",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rhpki-tps@7.3.0-23.el4?arch=i386"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i386"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pkisetup-0:7.3.0-14.el4.noarch as a component of Red Hat Certificate System 7.3 for 4AS",
          "product_id": "4AS-CERT-7.3:pkisetup-0:7.3.0-14.el4.noarch"
        },
        "product_reference": "pkisetup-0:7.3.0-14.el4.noarch",
        "relates_to_product_reference": "4AS-CERT-7.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhpki-ca-0:7.3.0-17.el4.noarch as a component of Red Hat Certificate System 7.3 for 4AS",
          "product_id": "4AS-CERT-7.3:rhpki-ca-0:7.3.0-17.el4.noarch"
        },
        "product_reference": "rhpki-ca-0:7.3.0-17.el4.noarch",
        "relates_to_product_reference": "4AS-CERT-7.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhpki-common-0:7.3.0-40.el4.noarch as a component of Red Hat Certificate System 7.3 for 4AS",
          "product_id": "4AS-CERT-7.3:rhpki-common-0:7.3.0-40.el4.noarch"
        },
        "product_reference": "rhpki-common-0:7.3.0-40.el4.noarch",
        "relates_to_product_reference": "4AS-CERT-7.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhpki-kra-0:7.3.0-13.el4.noarch as a component of Red Hat Certificate System 7.3 for 4AS",
          "product_id": "4AS-CERT-7.3:rhpki-kra-0:7.3.0-13.el4.noarch"
        },
        "product_reference": "rhpki-kra-0:7.3.0-13.el4.noarch",
        "relates_to_product_reference": "4AS-CERT-7.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhpki-ocsp-0:7.3.0-11.el4.noarch as a component of Red Hat Certificate System 7.3 for 4AS",
          "product_id": "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-11.el4.noarch"
        },
        "product_reference": "rhpki-ocsp-0:7.3.0-11.el4.noarch",
        "relates_to_product_reference": "4AS-CERT-7.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhpki-ra-0:7.3.0-67.el4.noarch as a component of Red Hat Certificate System 7.3 for 4AS",
          "product_id": "4AS-CERT-7.3:rhpki-ra-0:7.3.0-67.el4.noarch"
        },
        "product_reference": "rhpki-ra-0:7.3.0-67.el4.noarch",
        "relates_to_product_reference": "4AS-CERT-7.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhpki-tks-0:7.3.0-12.el4.noarch as a component of Red Hat Certificate System 7.3 for 4AS",
          "product_id": "4AS-CERT-7.3:rhpki-tks-0:7.3.0-12.el4.noarch"
        },
        "product_reference": "rhpki-tks-0:7.3.0-12.el4.noarch",
        "relates_to_product_reference": "4AS-CERT-7.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhpki-tps-0:7.3.0-23.el4.i386 as a component of Red Hat Certificate System 7.3 for 4AS",
          "product_id": "4AS-CERT-7.3:rhpki-tps-0:7.3.0-23.el4.i386"
        },
        "product_reference": "rhpki-tps-0:7.3.0-23.el4.i386",
        "relates_to_product_reference": "4AS-CERT-7.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhpki-tps-0:7.3.0-23.el4.x86_64 as a component of Red Hat Certificate System 7.3 for 4AS",
          "product_id": "4AS-CERT-7.3:rhpki-tps-0:7.3.0-23.el4.x86_64"
        },
        "product_reference": "rhpki-tps-0:7.3.0-23.el4.x86_64",
        "relates_to_product_reference": "4AS-CERT-7.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhpki-util-0:7.3.0-20.el4.noarch as a component of Red Hat Certificate System 7.3 for 4AS",
          "product_id": "4AS-CERT-7.3:rhpki-util-0:7.3.0-20.el4.noarch"
        },
        "product_reference": "rhpki-util-0:7.3.0-20.el4.noarch",
        "relates_to_product_reference": "4AS-CERT-7.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pkisetup-0:7.3.0-14.el4.noarch as a component of Red Hat Certificate System 7.3 for 4ES",
          "product_id": "4ES-CERT-7.3:pkisetup-0:7.3.0-14.el4.noarch"
        },
        "product_reference": "pkisetup-0:7.3.0-14.el4.noarch",
        "relates_to_product_reference": "4ES-CERT-7.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhpki-ca-0:7.3.0-17.el4.noarch as a component of Red Hat Certificate System 7.3 for 4ES",
          "product_id": "4ES-CERT-7.3:rhpki-ca-0:7.3.0-17.el4.noarch"
        },
        "product_reference": "rhpki-ca-0:7.3.0-17.el4.noarch",
        "relates_to_product_reference": "4ES-CERT-7.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhpki-common-0:7.3.0-40.el4.noarch as a component of Red Hat Certificate System 7.3 for 4ES",
          "product_id": "4ES-CERT-7.3:rhpki-common-0:7.3.0-40.el4.noarch"
        },
        "product_reference": "rhpki-common-0:7.3.0-40.el4.noarch",
        "relates_to_product_reference": "4ES-CERT-7.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhpki-kra-0:7.3.0-13.el4.noarch as a component of Red Hat Certificate System 7.3 for 4ES",
          "product_id": "4ES-CERT-7.3:rhpki-kra-0:7.3.0-13.el4.noarch"
        },
        "product_reference": "rhpki-kra-0:7.3.0-13.el4.noarch",
        "relates_to_product_reference": "4ES-CERT-7.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhpki-ocsp-0:7.3.0-11.el4.noarch as a component of Red Hat Certificate System 7.3 for 4ES",
          "product_id": "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-11.el4.noarch"
        },
        "product_reference": "rhpki-ocsp-0:7.3.0-11.el4.noarch",
        "relates_to_product_reference": "4ES-CERT-7.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhpki-ra-0:7.3.0-67.el4.noarch as a component of Red Hat Certificate System 7.3 for 4ES",
          "product_id": "4ES-CERT-7.3:rhpki-ra-0:7.3.0-67.el4.noarch"
        },
        "product_reference": "rhpki-ra-0:7.3.0-67.el4.noarch",
        "relates_to_product_reference": "4ES-CERT-7.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhpki-tks-0:7.3.0-12.el4.noarch as a component of Red Hat Certificate System 7.3 for 4ES",
          "product_id": "4ES-CERT-7.3:rhpki-tks-0:7.3.0-12.el4.noarch"
        },
        "product_reference": "rhpki-tks-0:7.3.0-12.el4.noarch",
        "relates_to_product_reference": "4ES-CERT-7.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhpki-tps-0:7.3.0-23.el4.i386 as a component of Red Hat Certificate System 7.3 for 4ES",
          "product_id": "4ES-CERT-7.3:rhpki-tps-0:7.3.0-23.el4.i386"
        },
        "product_reference": "rhpki-tps-0:7.3.0-23.el4.i386",
        "relates_to_product_reference": "4ES-CERT-7.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhpki-tps-0:7.3.0-23.el4.x86_64 as a component of Red Hat Certificate System 7.3 for 4ES",
          "product_id": "4ES-CERT-7.3:rhpki-tps-0:7.3.0-23.el4.x86_64"
        },
        "product_reference": "rhpki-tps-0:7.3.0-23.el4.x86_64",
        "relates_to_product_reference": "4ES-CERT-7.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhpki-util-0:7.3.0-20.el4.noarch as a component of Red Hat Certificate System 7.3 for 4ES",
          "product_id": "4ES-CERT-7.3:rhpki-util-0:7.3.0-20.el4.noarch"
        },
        "product_reference": "rhpki-util-0:7.3.0-20.el4.noarch",
        "relates_to_product_reference": "4ES-CERT-7.3"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2008-2367",
      "discovery_date": "2007-07-27T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "451998"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Red Hat Certificate System 7.2 uses world-readable permissions for password.conf and unspecified other configuration files, which allows local users to discover passwords by reading these files.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "System: insecure config file permissions",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-CERT-7.3:pkisetup-0:7.3.0-14.el4.noarch",
          "4AS-CERT-7.3:rhpki-ca-0:7.3.0-17.el4.noarch",
          "4AS-CERT-7.3:rhpki-common-0:7.3.0-40.el4.noarch",
          "4AS-CERT-7.3:rhpki-kra-0:7.3.0-13.el4.noarch",
          "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-11.el4.noarch",
          "4AS-CERT-7.3:rhpki-ra-0:7.3.0-67.el4.noarch",
          "4AS-CERT-7.3:rhpki-tks-0:7.3.0-12.el4.noarch",
          "4AS-CERT-7.3:rhpki-tps-0:7.3.0-23.el4.i386",
          "4AS-CERT-7.3:rhpki-tps-0:7.3.0-23.el4.x86_64",
          "4AS-CERT-7.3:rhpki-util-0:7.3.0-20.el4.noarch",
          "4ES-CERT-7.3:pkisetup-0:7.3.0-14.el4.noarch",
          "4ES-CERT-7.3:rhpki-ca-0:7.3.0-17.el4.noarch",
          "4ES-CERT-7.3:rhpki-common-0:7.3.0-40.el4.noarch",
          "4ES-CERT-7.3:rhpki-kra-0:7.3.0-13.el4.noarch",
          "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-11.el4.noarch",
          "4ES-CERT-7.3:rhpki-ra-0:7.3.0-67.el4.noarch",
          "4ES-CERT-7.3:rhpki-tks-0:7.3.0-12.el4.noarch",
          "4ES-CERT-7.3:rhpki-tps-0:7.3.0-23.el4.i386",
          "4ES-CERT-7.3:rhpki-tps-0:7.3.0-23.el4.x86_64",
          "4ES-CERT-7.3:rhpki-util-0:7.3.0-20.el4.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2008-2367"
        },
        {
          "category": "external",
          "summary": "RHBZ#451998",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=451998"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2008-2367",
          "url": "https://www.cve.org/CVERecord?id=CVE-2008-2367"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2008-2367",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-2367"
        }
      ],
      "release_date": "2009-01-15T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2009-01-29T09:31:00+00:00",
          "details": "Users running Red Hat Certificate System on Red Hat Enterprise Linux:\n\nBefore applying this update, make sure that all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use the Red\nHat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259\n\nUsers running Red Hat Certificate System on Sun Solaris:\n\nUpdated Solaris packages, in .pkg format, are available in the Red Hat\nCertificate System Solaris channels on the Red Hat Network. This packages\nshould be installed or upgraded using Solaris-native package management\ntools.\n\nFor detailed installation instructions, see Chapter 2, \"Installation and\nConfiguration\", of the Red Hat Certificate System 7.3 Administration Guide:\nhttp://redhat.com/docs/manuals/cert-system/7.3/html/Administration_Guide/Administration_Guide-Installation_and_Configuration.html",
          "product_ids": [
            "4AS-CERT-7.3:pkisetup-0:7.3.0-14.el4.noarch",
            "4AS-CERT-7.3:rhpki-ca-0:7.3.0-17.el4.noarch",
            "4AS-CERT-7.3:rhpki-common-0:7.3.0-40.el4.noarch",
            "4AS-CERT-7.3:rhpki-kra-0:7.3.0-13.el4.noarch",
            "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-11.el4.noarch",
            "4AS-CERT-7.3:rhpki-ra-0:7.3.0-67.el4.noarch",
            "4AS-CERT-7.3:rhpki-tks-0:7.3.0-12.el4.noarch",
            "4AS-CERT-7.3:rhpki-tps-0:7.3.0-23.el4.i386",
            "4AS-CERT-7.3:rhpki-tps-0:7.3.0-23.el4.x86_64",
            "4AS-CERT-7.3:rhpki-util-0:7.3.0-20.el4.noarch",
            "4ES-CERT-7.3:pkisetup-0:7.3.0-14.el4.noarch",
            "4ES-CERT-7.3:rhpki-ca-0:7.3.0-17.el4.noarch",
            "4ES-CERT-7.3:rhpki-common-0:7.3.0-40.el4.noarch",
            "4ES-CERT-7.3:rhpki-kra-0:7.3.0-13.el4.noarch",
            "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-11.el4.noarch",
            "4ES-CERT-7.3:rhpki-ra-0:7.3.0-67.el4.noarch",
            "4ES-CERT-7.3:rhpki-tks-0:7.3.0-12.el4.noarch",
            "4ES-CERT-7.3:rhpki-tps-0:7.3.0-23.el4.i386",
            "4ES-CERT-7.3:rhpki-tps-0:7.3.0-23.el4.x86_64",
            "4ES-CERT-7.3:rhpki-util-0:7.3.0-20.el4.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2009:0007"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "System: insecure config file permissions"
    },
    {
      "cve": "CVE-2008-2368",
      "discovery_date": "2007-01-26T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "452000"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Red Hat Certificate System 7.2 stores passwords in cleartext in the UserDirEnrollment log, the RA wizard installer log, and unspecified other debug log files, and uses weak permissions for these files, which allows local users to discover passwords by reading the files.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "System: plain text passwords stored in debug log",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-CERT-7.3:pkisetup-0:7.3.0-14.el4.noarch",
          "4AS-CERT-7.3:rhpki-ca-0:7.3.0-17.el4.noarch",
          "4AS-CERT-7.3:rhpki-common-0:7.3.0-40.el4.noarch",
          "4AS-CERT-7.3:rhpki-kra-0:7.3.0-13.el4.noarch",
          "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-11.el4.noarch",
          "4AS-CERT-7.3:rhpki-ra-0:7.3.0-67.el4.noarch",
          "4AS-CERT-7.3:rhpki-tks-0:7.3.0-12.el4.noarch",
          "4AS-CERT-7.3:rhpki-tps-0:7.3.0-23.el4.i386",
          "4AS-CERT-7.3:rhpki-tps-0:7.3.0-23.el4.x86_64",
          "4AS-CERT-7.3:rhpki-util-0:7.3.0-20.el4.noarch",
          "4ES-CERT-7.3:pkisetup-0:7.3.0-14.el4.noarch",
          "4ES-CERT-7.3:rhpki-ca-0:7.3.0-17.el4.noarch",
          "4ES-CERT-7.3:rhpki-common-0:7.3.0-40.el4.noarch",
          "4ES-CERT-7.3:rhpki-kra-0:7.3.0-13.el4.noarch",
          "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-11.el4.noarch",
          "4ES-CERT-7.3:rhpki-ra-0:7.3.0-67.el4.noarch",
          "4ES-CERT-7.3:rhpki-tks-0:7.3.0-12.el4.noarch",
          "4ES-CERT-7.3:rhpki-tps-0:7.3.0-23.el4.i386",
          "4ES-CERT-7.3:rhpki-tps-0:7.3.0-23.el4.x86_64",
          "4ES-CERT-7.3:rhpki-util-0:7.3.0-20.el4.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2008-2368"
        },
        {
          "category": "external",
          "summary": "RHBZ#452000",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=452000"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2008-2368",
          "url": "https://www.cve.org/CVERecord?id=CVE-2008-2368"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2008-2368",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-2368"
        }
      ],
      "release_date": "2009-01-15T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2009-01-29T09:31:00+00:00",
          "details": "Users running Red Hat Certificate System on Red Hat Enterprise Linux:\n\nBefore applying this update, make sure that all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use the Red\nHat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259\n\nUsers running Red Hat Certificate System on Sun Solaris:\n\nUpdated Solaris packages, in .pkg format, are available in the Red Hat\nCertificate System Solaris channels on the Red Hat Network. This packages\nshould be installed or upgraded using Solaris-native package management\ntools.\n\nFor detailed installation instructions, see Chapter 2, \"Installation and\nConfiguration\", of the Red Hat Certificate System 7.3 Administration Guide:\nhttp://redhat.com/docs/manuals/cert-system/7.3/html/Administration_Guide/Administration_Guide-Installation_and_Configuration.html",
          "product_ids": [
            "4AS-CERT-7.3:pkisetup-0:7.3.0-14.el4.noarch",
            "4AS-CERT-7.3:rhpki-ca-0:7.3.0-17.el4.noarch",
            "4AS-CERT-7.3:rhpki-common-0:7.3.0-40.el4.noarch",
            "4AS-CERT-7.3:rhpki-kra-0:7.3.0-13.el4.noarch",
            "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-11.el4.noarch",
            "4AS-CERT-7.3:rhpki-ra-0:7.3.0-67.el4.noarch",
            "4AS-CERT-7.3:rhpki-tks-0:7.3.0-12.el4.noarch",
            "4AS-CERT-7.3:rhpki-tps-0:7.3.0-23.el4.i386",
            "4AS-CERT-7.3:rhpki-tps-0:7.3.0-23.el4.x86_64",
            "4AS-CERT-7.3:rhpki-util-0:7.3.0-20.el4.noarch",
            "4ES-CERT-7.3:pkisetup-0:7.3.0-14.el4.noarch",
            "4ES-CERT-7.3:rhpki-ca-0:7.3.0-17.el4.noarch",
            "4ES-CERT-7.3:rhpki-common-0:7.3.0-40.el4.noarch",
            "4ES-CERT-7.3:rhpki-kra-0:7.3.0-13.el4.noarch",
            "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-11.el4.noarch",
            "4ES-CERT-7.3:rhpki-ra-0:7.3.0-67.el4.noarch",
            "4ES-CERT-7.3:rhpki-tks-0:7.3.0-12.el4.noarch",
            "4ES-CERT-7.3:rhpki-tps-0:7.3.0-23.el4.i386",
            "4ES-CERT-7.3:rhpki-tps-0:7.3.0-23.el4.x86_64",
            "4ES-CERT-7.3:rhpki-util-0:7.3.0-20.el4.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2009:0007"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "System: plain text passwords stored in debug log"
    },
    {
      "cve": "CVE-2008-5082",
      "discovery_date": "2008-11-26T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "475998"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The verifyProof function in the Token Processing System (TPS) component in Red Hat Certificate System (RHCS) 7.1 through 7.3 and Dogtag Certificate System 1.0 returns successfully even when token enrollment did not use the hardware key, which allows remote authenticated users with enrollment privileges to bypass intended authentication policies by performing enrollment with a software key.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "System: missing public key challenge proof verification in the TPS component",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-CERT-7.3:pkisetup-0:7.3.0-14.el4.noarch",
          "4AS-CERT-7.3:rhpki-ca-0:7.3.0-17.el4.noarch",
          "4AS-CERT-7.3:rhpki-common-0:7.3.0-40.el4.noarch",
          "4AS-CERT-7.3:rhpki-kra-0:7.3.0-13.el4.noarch",
          "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-11.el4.noarch",
          "4AS-CERT-7.3:rhpki-ra-0:7.3.0-67.el4.noarch",
          "4AS-CERT-7.3:rhpki-tks-0:7.3.0-12.el4.noarch",
          "4AS-CERT-7.3:rhpki-tps-0:7.3.0-23.el4.i386",
          "4AS-CERT-7.3:rhpki-tps-0:7.3.0-23.el4.x86_64",
          "4AS-CERT-7.3:rhpki-util-0:7.3.0-20.el4.noarch",
          "4ES-CERT-7.3:pkisetup-0:7.3.0-14.el4.noarch",
          "4ES-CERT-7.3:rhpki-ca-0:7.3.0-17.el4.noarch",
          "4ES-CERT-7.3:rhpki-common-0:7.3.0-40.el4.noarch",
          "4ES-CERT-7.3:rhpki-kra-0:7.3.0-13.el4.noarch",
          "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-11.el4.noarch",
          "4ES-CERT-7.3:rhpki-ra-0:7.3.0-67.el4.noarch",
          "4ES-CERT-7.3:rhpki-tks-0:7.3.0-12.el4.noarch",
          "4ES-CERT-7.3:rhpki-tps-0:7.3.0-23.el4.i386",
          "4ES-CERT-7.3:rhpki-tps-0:7.3.0-23.el4.x86_64",
          "4ES-CERT-7.3:rhpki-util-0:7.3.0-20.el4.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2008-5082"
        },
        {
          "category": "external",
          "summary": "RHBZ#475998",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=475998"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2008-5082",
          "url": "https://www.cve.org/CVERecord?id=CVE-2008-5082"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2008-5082",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-5082"
        }
      ],
      "release_date": "2009-01-29T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2009-01-29T09:31:00+00:00",
          "details": "Users running Red Hat Certificate System on Red Hat Enterprise Linux:\n\nBefore applying this update, make sure that all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use the Red\nHat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259\n\nUsers running Red Hat Certificate System on Sun Solaris:\n\nUpdated Solaris packages, in .pkg format, are available in the Red Hat\nCertificate System Solaris channels on the Red Hat Network. This packages\nshould be installed or upgraded using Solaris-native package management\ntools.\n\nFor detailed installation instructions, see Chapter 2, \"Installation and\nConfiguration\", of the Red Hat Certificate System 7.3 Administration Guide:\nhttp://redhat.com/docs/manuals/cert-system/7.3/html/Administration_Guide/Administration_Guide-Installation_and_Configuration.html",
          "product_ids": [
            "4AS-CERT-7.3:pkisetup-0:7.3.0-14.el4.noarch",
            "4AS-CERT-7.3:rhpki-ca-0:7.3.0-17.el4.noarch",
            "4AS-CERT-7.3:rhpki-common-0:7.3.0-40.el4.noarch",
            "4AS-CERT-7.3:rhpki-kra-0:7.3.0-13.el4.noarch",
            "4AS-CERT-7.3:rhpki-ocsp-0:7.3.0-11.el4.noarch",
            "4AS-CERT-7.3:rhpki-ra-0:7.3.0-67.el4.noarch",
            "4AS-CERT-7.3:rhpki-tks-0:7.3.0-12.el4.noarch",
            "4AS-CERT-7.3:rhpki-tps-0:7.3.0-23.el4.i386",
            "4AS-CERT-7.3:rhpki-tps-0:7.3.0-23.el4.x86_64",
            "4AS-CERT-7.3:rhpki-util-0:7.3.0-20.el4.noarch",
            "4ES-CERT-7.3:pkisetup-0:7.3.0-14.el4.noarch",
            "4ES-CERT-7.3:rhpki-ca-0:7.3.0-17.el4.noarch",
            "4ES-CERT-7.3:rhpki-common-0:7.3.0-40.el4.noarch",
            "4ES-CERT-7.3:rhpki-kra-0:7.3.0-13.el4.noarch",
            "4ES-CERT-7.3:rhpki-ocsp-0:7.3.0-11.el4.noarch",
            "4ES-CERT-7.3:rhpki-ra-0:7.3.0-67.el4.noarch",
            "4ES-CERT-7.3:rhpki-tks-0:7.3.0-12.el4.noarch",
            "4ES-CERT-7.3:rhpki-tps-0:7.3.0-23.el4.i386",
            "4ES-CERT-7.3:rhpki-tps-0:7.3.0-23.el4.x86_64",
            "4ES-CERT-7.3:rhpki-util-0:7.3.0-20.el4.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2009:0007"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "System: missing public key challenge proof verification in the TPS component"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.