Serena Dimensions CM SSL Certificate Signature Verification Vulnerability
BID:35073
Info
Serena Dimensions CM SSL Certificate Signature Verification Vulnerability
| Bugtraq ID: | 35073 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 22 2009 12:00AM |
| Updated: | Jun 22 2009 07:49PM |
| Credit: | [email protected] |
| Vulnerable: |
Serena Dimensions CM 10.1 |
| Not Vulnerable: | |
Discussion
Serena Dimensions CM SSL Certificate Signature Verification Vulnerability
Serena Dimensions CM is prone to a signature-verification vulnerability.
An attacker would likely leverage this issue by first carrying out a man-in-the-middle attack. The attacker may then obtain sensitive information or modify communications. Other attacks are likely possible.
Dimensions CM 10.1 is vulnerable; other versions may also be affected.
Serena Dimensions CM is prone to a signature-verification vulnerability.
An attacker would likely leverage this issue by first carrying out a man-in-the-middle attack. The attacker may then obtain sensitive information or modify communications. Other attacks are likely possible.
Dimensions CM 10.1 is vulnerable; other versions may also be affected.
Exploit / POC
Serena Dimensions CM SSL Certificate Signature Verification Vulnerability
An attacker may use readily available utilities to carry out this attack.
An attacker may use readily available utilities to carry out this attack.
Solution / Fix
Serena Dimensions CM SSL Certificate Signature Verification Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
NOTE: The vendor reports that in a typical scenario, the Desktop Client would not be used over the web, limiting attacks to the local network. Subsequently, the vendor doesn't consider it necessary to verify the server.
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
NOTE: The vendor reports that in a typical scenario, the Desktop Client would not be used over the web, limiting attacks to the local network. Subsequently, the vendor doesn't consider it necessary to verify the server.
References
Serena Dimensions CM SSL Certificate Signature Verification Vulnerability
References:
References: