SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com






Category:   Application (Security)  >   Red Hat Certificate Server Vendors:   Red Hat
Red Hat Certificate System Bugs Let Remote Users Obtain One-Time PINs and Generate Certificates
SecurityTracker Alert ID:  1024697
SecurityTracker URL:  http://securitytracker.com/id/1024697
CVE Reference:   CVE-2004-2761, CVE-2010-3868, CVE-2010-3869   (Links to External Site)
Date:  Nov 8 2010
Impact:   Disclosure of authentication information, Modification of user information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 8
Description:   Several vulnerabilities were reported in Red Hat Certificate System. A remote user can obtain one-time PINs in certain situations. A remote user can generate signed text. A remote user can generate certificates.

A remote user can conduct an MD5 chosen-prefix collision attack to generate attack-chosen SCEP protocol output signed using the certificate authority's key [CVE-2004-2761].

A remote user can request a one-time PIN in an SCEP request to be decrypted by the certificate authority [CVE-2010-3868].

A remote user with a valid SCEP enrollment one-time PIN can re-use the PIN to generate an unlimited number of certificates [CVE-2010-3869].

Impact:   A remote user can obtain one-time PINs in certain situations.

A remote user can generate signed text output.

A remote user can generate certificates.

Solution:   The vendor has issued a fix.

The vendor's advisory is available at:

https://rhn.redhat.com/errata/RHSA-2010-0838.html

Vendor URL:  rhn.redhat.com/errata/RHSA-2010-0838.html (Links to External Site)
Cause:   Access control error
Underlying OS:   Linux (Red Hat Enterprise)

Message History:   This archive entry has one or more follow-up message(s) listed below.
Nov 8 2010 (Red Hat Issues Fix) Red Hat Certificate System Bugs Let Remote Users Obtain One-Time PINs and Generate Certificates   (bugzilla@redhat.com)
Red Hat has issued a fix for Red Hat Certificate System 7.3.



 Source Message Contents

Date:  Mon, 8 Nov 2010 13:27:54 -0700
Subject:  [RHSA-2010:0838-01] Moderate: pki security and enhancement update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: pki security and enhancement update
Advisory ID:       RHSA-2010:0838-01
Product:           Red Hat Certificate System
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2010-0838.html
Issue date:        2010-11-08
CVE Names:         CVE-2004-2761 CVE-2010-3868 CVE-2010-3869 
=====================================================================

1. Summary:

Updated pki-ca, pki-util, and pki-common packages that fix three security
issues and add several enhancements are now available for Red Hat
Certificate System 8.

The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

2. Relevant releases/architectures:

Red Hat Certificate System 8 - noarch

3. Description:

Red Hat Certificate System is an enterprise software system designed to
manage enterprise public key infrastructure (PKI) deployments. Simple
Certificate Enrollment Protocol (SCEP) is a PKI communication protocol
used to automatically enroll certificates for network devices.

The certificate authority allowed unauthenticated users to request the
one-time PIN in an SCEP request to be decrypted. An attacker able to sniff
an SCEP request from a network device could request the certificate
authority to decrypt the request, allowing them to obtain the one-time
PIN. With this update, the certificate authority only handles decryption
requests from authenticated registration authorities. (CVE-2010-3868)

The certificate authority allowed the one-time PIN used in SCEP requests
to be re-used. An attacker possessing a valid SCEP enrollment one-time PIN
could use it to generate an unlimited number of certificates.
(CVE-2010-3869)

The certificate authority used the MD5 hash algorithm to sign all SCEP
protocol responses. As MD5 is not collision resistant, an attacker could
use this flaw to perform an MD5 chosen-prefix collision attack to generate
attack-chosen output signed using the certificate authority's key.
(CVE-2004-2761)

This update also adds the following enhancements:

* New configuration options for the SCEP server can define the default and
allowed encryption and hash algorithms. These options allow disabling uses
of the weaker algorithms not required by network devices and prevent
possible downgrade attacks. These can be configured by adding the following
options to the certificate authority's CS.cfg configuration file:

   ca.scep.encryptionAlgorithm=DES3
   ca.scep.allowedEncryptionAlgorithms=DES3
   ca.scep.hashAlgorithm=SHA1
   ca.scep.allowedHashAlgorithms=SHA1,SHA256,SHA512

* With this update, the certificate authority's SCEP server is disabled by
default. The SCEP server can be enabled by adding the 'ca.scep.enable=true'
option to the certificate authority's CS.cfg configuration file.

* A separate key pair can now be configured for use in SCEP communication.
Previously, the main certificate authority's key pair was used for SCEP
communication too. A designated SCEP key pair can be referenced by adding
a new option, ca.scep.nickname=[scep certificate nickname], to the
certificate authority's CS.cfg configuration file.

* The certificate authority now allows the size of nonces used in SCEP
requests to be restricted by adding a new option, ca.scep.nonceSizeLimit=
[number of bytes], to the certificate authority's CS.cfg configuration
file. The limit is set to 16 bytes in the default CS.cfg configuration
file.

All users of Red Hat Certificate System 8 should upgrade to these updated
packages, which resolve these issues and add these enhancements.

4. Solution:

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

648882 - CVE-2010-3868 Certificate System: unauthenticated user can request SCEP one-time PIN decryption
648883 - CVE-2010-3869 Certificate System: SCEP one-time PIN reuse
648886 - CVE-2004-2761 MD5: MD5 Message-Digest Algorithm is not collision resistant

6. Package List:

Red Hat Certificate System 8:

Source:
pki-ca-8.0.7-1.el5pki.src.rpm
pki-common-8.0.6-2.el5pki.src.rpm
pki-util-8.0.5-1.el5pki.src.rpm

noarch:
pki-ca-8.0.7-1.el5pki.noarch.rpm
pki-common-8.0.6-2.el5pki.noarch.rpm
pki-common-javadoc-8.0.6-2.el5pki.noarch.rpm
pki-util-8.0.5-1.el5pki.noarch.rpm
pki-util-javadoc-8.0.5-1.el5pki.noarch.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

https://www.redhat.com/security/data/cve/CVE-2004-2761.html
https://www.redhat.com/security/data/cve/CVE-2010-3868.html
https://www.redhat.com/security/data/cve/CVE-2010-3869.html
http://www.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2010 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFM2F03XlSAg2UNWIIRAgXXAKDEyATxbggfyGsg8a2z8R4Ic1ZiMQCfbBbt
YlLAX1lKZpWDyltWoNw4Bi0=
=DZVc
-----END PGP SIGNATURE-----


--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

Copyright 2014, SecurityGlobal.net LLC