Red Hat Certificate System 'agent/request/op.cgi' Security Bypass Vulnerability

Bugtraq ID:	35104
Class:	Unknown
CVE:	CVE-2009-0588
Remote:	No
Local:	Yes
Published:	May 26 2009 12:00AM
Updated:	Oct 29 2010 12:48PM
Credit:	Robert Mead of AusCERT
Vulnerable:	Red Hat Dogtag Certificate System 1.1.0
Not Vulnerable:

Red Hat Certificate System 'agent/request/op.cgi' Security Bypass Vulnerability

Red Hat Certificate System (RHCS) is prone to a security-bypass vulnerability because of an error related to the handling of multiple agent groups.

Successfully exploiting this issue allows agent groups to approve or reject certificates in arbitrary queues; this may aid in further attacks.

RHCS 7.3 is vulnerable; other versions may also be affected.

Red Hat Certificate System 'agent/request/op.cgi' Security Bypass Vulnerability

Attackers will likely use standard tools to exploit this issue.

Red Hat Certificate System 'agent/request/op.cgi' Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for more information.

Red Hat Certificate System 'agent/request/op.cgi' Security Bypass Vulnerability

References:

• Red Hat Certificate System Homepage (Red Hat)
  
• Moderate: rhpki-ra security update (Red Hat)