BID:9123

OpenCA Signature Verification Vulnerabilities

Info

OpenCA Signature Verification Vulnerabilities

Bugtraq ID:	9123
Class:	Unknown
CVE:	CVE-2003-0960
Remote:	Yes
Local:	No
Published:	Nov 28 2003 12:00AM
Updated:	Jul 12 2009 12:56AM
Credit:	Discovery is credited to Chris Covell and Gottfried Scheckenbach.
Vulnerable:	OpenCA OpenCA 0.9.1 -3 OpenCA OpenCA 0.9.1 -2 OpenCA OpenCA 0.9.1 -1 OpenCA OpenCA 0.9.1 OpenCA OpenCA 0.9 .0-2 OpenCA OpenCA 0.9 .0-1 OpenCA OpenCA 0.9 .0 OpenCA OpenCA 0.8.6 OpenCA OpenCA 0.8.1 OpenCA OpenCA 0.8 .0

Not Vulnerable:	OpenCA OpenCA 0.9.1 -4

Discussion

OpenCA Signature Verification Vulnerabilities

Multiple flaws have been reported in OpenCA which cumulatively could cause a revoked or expired certificate to be accepted. This could present a serious security risk in situations where digital signatures are used to verify the authenticity of content or in access validation.

Exploit / POC

OpenCA Signature Verification Vulnerabilities

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Solution / Fix

OpenCA Signature Verification Vulnerabilities

Solution:
This issue has been resolved in OpenCA 0.9.1-4. Snapshots newer than openca-0.9-SNAP-20031125.tar.gz also include fixes for this issue. The vendor has also included a patch in their advisory.

OpenCA OpenCA 0.8 .0