NVD

Id
4869  
Name
CVE-2008-5082  
Description
The verifyProof function in the Token Processing System (TPS) component in Red Hat Certificate System (RHCS) 7.1 through 7.3 and Dogtag Certificate System 1.0 returns successfully even when token enrollment did not use the hardware key, which allows remote authenticated users with enrollment privileges to bypass intended authentication policies by performing enrollment with a software key.  
Reject
 
CVSS Version
2  
CVSS Score
6  
Severity
Medium  
CVSS Base Score
6  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
6.8  
CVSS Vector
(AV:N/AC:M/Au:S/C:P/I:P/A:P)  
Pub Date
2017-01-03  
Published
2009-01-30  
Modified Date
2011-03-07  
Seq
2008-5082  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
30659 4869 CVE-2008-5082 33508  View
30660 4869 CVE-2008-5082 ADV-2009-0145  View
30661 4869 CVE-2008-5082 redhat-cs-tps-security-bypass(48331)  View
30662 4869 CVE-2008-5082 https://bugzilla.redhat.com/show_bug.cgi?id=475998  View
30663 4869 CVE-2008-5082 RHSA-2009:0007  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
40704 JVNDB-2009-001710 RHCS および Dogtag Certificate System の TPS コンポーネントに含まれる verifyProof 関数における意図されたアクセス制限を回避される脆弱性 Red Hat Certificate System (RHCS) および Dogtag Certificate System の Token Processing System (TPS) コンポーネントに含まれる verifyProof 関数は、トークン登録がハードウェアキーを使用していない場合でさえ、値を返すため、意図されたアクセス制限を回避される脆弱性が存在します。 CVE-2008-5082 35195 CVE-2008-5082 4869 6 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001710.html 2009-01-30 2009-07-08 View