CVE-2008-5082 – System: missing public key challenge proof verification in the TPS component

https://notcve.org/view.php?id=CVE-2008-5082

The verifyProof function in the Token Processing System (TPS) component in Red Hat Certificate System (RHCS) 7.1 through 7.3 and Dogtag Certificate System 1.0 returns successfully even when token enrollment did not use the hardware key, which allows remote authenticated users with enrollment privileges to bypass intended authentication policies by performing enrollment with a software key. La función verifyProof en el componente Token Processing System (TPS) en Red Hat Certificate System (RHCS) v7.1 hasta v7.3 y Dogtag Certificate System v1.0 devuelve con éxito incluso cuando el token implicado no utiliza la clave hardware, lo cual permite a usuarios remotos autenticados con privilegios implicados evitar políticas de autenticación intencionadas implicándose con una clave software. • http://secunia.com/advisories/33693 http://www.securityfocus.com/bid/33508 http://www.vupen.com/english/advisories/2009/0145 https://bugzilla.redhat.com/show_bug.cgi?id=475998 https://exchange.xforce.ibmcloud.com/vulnerabilities/48331 https://rhn.redhat.com/errata/RHSA-2009-0007.html https://access.redhat.com/security/cve/CVE-2008-5082 • CWE-287: Improper Authentication •