OpenCA bypass signature verification
| openca-signature-verification-bypass (13861) |  Medium Risk |
Description:
OpenCA could allow an attacker to bypass signature verification. OpenCA fails to apply the correct certificate in a chain to validate the certificate's serial. A remote or local attacker could exploit this vulnerability by using a revoked or expired certificate to gain unauthorized access to an application using OpenCA.
Platforms Affected:
- OpenCA, OpenCA 0.9.1.3 and prior
Remedy:
Upgrade to the latest version of OpenCA (0.9.1.4 or later), available from the OpenCA Web site. See References.
Consequences:
Gain Access
References:
- OpenCA Security Advisory [28 November 2003] , Vulnerabilities in signature verification at http://archives.neohapsis.com/archives/bugtraq/2003-11/0332.html.
- OpenCA Web site, OpenCA PKI Development Project at http://www.openca.org/openca/.
- BID-9123: OpenCA Signature Verification Vulnerabilities
- CVE-2003-0960: OpenCA before 0.9.1.4 does not use the correct certificate in a chain to check the serial, which could cause OpenCA to accept revoked or expired certificates.
Reported:
Nov 28, 2003
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net