Vulnerabilities > CVE-2008-5410 - Cryptographic Issues vulnerability in SUN Solaris 10.0

047910
CVSS 7.8 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
COMPLETE
network
low complexity
sun
CWE-310
nessus
NVD
Published: 2008-12-10
Updated: 2017-09-29

Summary

The PK11_SESSION cache in the OpenSSL PKCS#11 engine in Sun Solaris 10 does not maintain reference counts for operations with asymmetric keys, which allows context-dependent attackers to cause a denial of service (failed cryptographic operations) via unspecified vectors, related to the (1) RSA_sign and (2) RSA_verify functions.

Vulnerable Configurations

Part Description Count
OS
Sun
2

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Signature Spoofing by Key Recreation
    An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.

Nessus

  • NASL familySolaris Local Security Checks
    NASL idSOLARIS10_139459.NASL
    descriptionSunOS 5.10: libcrypto.so.0.9.7 patch. Date this patch was last updated by Sun : Dec/02/08
    last seen2018-09-01
    modified2018-08-13
    plugin id35201
    published2008-12-17
    reporterTenable
    sourcehttps://www.tenable.com/plugins/index.php?view=single&id=35201
    titleSolaris 10 (sparc) : 139459-01
  • NASL familySolaris Local Security Checks
    NASL idSOLARIS10_139459-01.NASL
    descriptionSunOS 5.10: libcrypto.so.0.9.7 patch. Date this patch was last updated by Sun : Dec/02/08
    last seen2020-06-01
    modified2020-06-02
    plugin id107513
    published2018-03-12
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/107513
    titleSolaris 10 (sparc) : 139459-01
  • NASL familySolaris Local Security Checks
    NASL idSOLARIS10_X86_138863.NASL
    descriptionSunOS 5.10_x86: libcrypto.so.0.9.7 patch. Date this patch was last updated by Sun : Dec/02/08
    last seen2018-09-01
    modified2018-08-13
    plugin id35210
    published2008-12-17
    reporterTenable
    sourcehttps://www.tenable.com/plugins/index.php?view=single&id=35210
    titleSolaris 10 (x86) : 138863-02

Oval

accepted2009-02-16T04:00:23.547-05:00
classvulnerability
contributors
nameMichael Wood
organizationHewlett-Packard
definition_extensions
  • commentSolaris 10 (SPARC) is installed
    ovaloval:org.mitre.oval:def:1440
  • commentSolaris 10 (x86) is installed
    ovaloval:org.mitre.oval:def:1926
descriptionThe PK11_SESSION cache in the OpenSSL PKCS#11 engine in Sun Solaris 10 does not maintain reference counts for operations with asymmetric keys, which allows context-dependent attackers to cause a denial of service (failed cryptographic operations) via unspecified vectors, related to the (1) RSA_sign and (2) RSA_verify functions.
familyunix
idoval:org.mitre.oval:def:5914
statusaccepted
submitted2009-01-05T16:39:26.000-05:00
titleA Security Vulnerability in the OpenSSL PKCS#11 Engine May Result in Denial of Service (DoS) Due to a Corrupted Session Cache
version35

References