NVD

Id
3132  
Name
CVE-2008-3249  
Description
The client in Lenovo System Update before 3.14 does not properly validate the certificate when establishing an SSL connection, which allows remote attackers to install arbitrary packages via an SSL certificate whose X.509 headers match a public certificate used by IBM.  
Reject
 
CVSS Version
2  
CVSS Score
5.1  
Severity
Medium  
CVSS Base Score
5.1  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
4.9  
CVSS Vector
(AV:N/AC:H/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-03  
Published
2008-07-21  
Modified Date
2009-04-08  
Seq
2008-3249  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
19882 3132 CVE-2008-3249 1020112  View
19883 3132 CVE-2008-3249 http://www.security-objectives.com/advisories/SECOBJADV-2008-01.txt  View
19884 3132 CVE-2008-3249 20080525 SECOBJADV-2008-01: Lenovo SystemUpdate SSL Certificate Issuer Spoofing Vulnerability  View
19885 3132 CVE-2008-3249 29366  View
19886 3132 CVE-2008-3249 ibm-thinkvantage-ssl-spoofing(42638)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
49344 JVNDB-2008-004654 Lenovo System Update のクライアントにおける任意のパッケージをインストールされる脆弱性 Lenovo System Update のクライアントには、SSL 接続を確立している際、証明書を適切に検証しないため、任意のパッケージをインストールされる脆弱性が存在します。 CVE-2008-3249 33362 CVE-2008-3249 3132 5.1 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-004654.html 2008-07-21 2012-09-25 View