CVE-2008-5082 | BDVDB-2026-34589 Detail

Description#

The verifyProof function in the Token Processing System (TPS) component in Red Hat Certificate System (RHCS) 7.1 through 7.3 and Dogtag Certificate System 1.0 returns successfully even when token enrollment did not use the hardware key, which allows remote authenticated users with enrollment privileges to bypass intended authentication policies by performing enrollment with a software key.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://www.securityfocus.com/bid/33508
https://bugzilla.redhat.com/show_bug.cgi?id=475998
https://exchange.xforce.ibmcloud.com/vulnerabilities/48331
http://www.vupen.com/english/advisories/2009/0145
https://rhn.redhat.com/errata/RHSA-2009-0007.html
http://secunia.com/advisories/33693

Exploit#

No public exploit known

History#

Version 12009-01-30Record published in the CVE List.
Version 22024-08-07Most recent update recorded in the CVE List.