Vulnerabilities > CVE-2011-5121 - Cryptographic Issues vulnerability in Comodo Internet Security

CVSS 10.0 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

COMPLETE

Integrity impact

COMPLETE

Availability impact

COMPLETE

network

low complexity

comodo

CWE-310

critical

NVD

Published: 2012-08-26

Updated: 2012-08-27

Summary

The Antivirus component in Comodo Internet Security before 5.3.175888.1227 does not properly check whether unspecified X.509 certificates are revoked, which has unknown impact and remote attack vectors.

Vulnerable Configurations

Part	Description	Count
Application	Comodo Comodo Comodo Internet Security 3.0.14.276 Comodo Comodo Internet Security 3.0.15.277 Comodo Comodo Internet Security 3.0.16.295 Comodo Comodo Internet Security 3.0.17.304 Comodo Comodo Internet Security 3.0.18.309 Comodo Comodo Internet Security 3.0.19.318 Comodo Comodo Internet Security 3.0.20.320 Comodo Comodo Internet Security 3.0.22.349 Comodo Comodo Internet Security 3.0.23.364 Comodo Comodo Internet Security 3.0.24.368 Comodo Comodo Internet Security 3.0.25.378 Comodo Comodo Internet Security 3.5.53896.424 Comodo Comodo Internet Security 3.5.54375.427 Comodo Comodo Internet Security 3.5.55810.432 Comodo Comodo Internet Security 3.5.57173.439 Comodo Comodo Internet Security 3.8.64263.468 Comodo Comodo Internet Security 3.8.64739.471 Comodo Comodo Internet Security 3.8.65951.477 Comodo Comodo Internet Security 3.9.95478.509 Comodo Comodo Internet Security 3.10.102363.531 Comodo Comodo Internet Security 3.11.108364.552 Comodo Comodo Internet Security 3.12.111745.560 Comodo Comodo Internet Security 3.13.121240.574 Comodo Comodo Internet Security 3.13.125662.579 Comodo Comodo Internet Security 3.14.130099.587 Comodo Comodo Internet Security 4.0.138377.779 Comodo Comodo Internet Security 4.0.141842.828 Comodo Comodo Internet Security 4.1.150349.920 Comodo Comodo Internet Security 5.0.163652.1142 Comodo Comodo Internet Security 5.3.174622.1216	30

Common Weakness Enumeration (CWE)

CWE-310 - Cryptographic Issues

Common Attack Pattern Enumeration and Classification (CAPEC)

Signature Spoofing by Key Recreation
An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.

References

http://personalfirewall.comodo.com/release_notes.html