1. CVE-Search
  2. CVE-2008-3270
ID CVE-2008-3270
Summary yum-rhn-plugin in Red Hat Enterprise Linux (RHEL) 5 does not verify the SSL certificate for a file download from a Red Hat Network (RHN) server, which makes it easier for remote man-in-the-middle attackers to cause a denial of service (loss of updates) or force the download and installation of official Red Hat packages that were not requested.
References
Vulnerable Configurations
  • cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*
CVSS
Base: 2.6 (as of 29-09-2017 - 01:31)
Impact:
Exploitability:
CWE CWE-310
CAPEC
  • Signature Spoofing by Key Recreation
    An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
Access
VectorComplexityAuthentication
NETWORK HIGH NONE
Impact
ConfidentialityIntegrityAvailability
NONE PARTIAL NONE
cvss-vector via4 AV:N/AC:H/Au:N/C:N/I:P/A:N
oval via4
accepted 2013-04-29T04:09:28.551-04:00
class vulnerability
contributors
  • name Aharon Chernin
    organization SCAP.com, LLC
  • name Dragos Prisaca
    organization G2, Inc.
definition_extensions
  • comment The operating system installed on the system is Red Hat Enterprise Linux 5
    oval oval:org.mitre.oval:def:11414
  • comment The operating system installed on the system is CentOS Linux 5.x
    oval oval:org.mitre.oval:def:15802
  • comment Oracle Linux 5.x
    oval oval:org.mitre.oval:def:15459
description yum-rhn-plugin in Red Hat Enterprise Linux (RHEL) 5 does not verify the SSL certificate for a file download from a Red Hat Network (RHN) server, which makes it easier for remote man-in-the-middle attackers to cause a denial of service (loss of updates) or force the download and installation of official Red Hat packages that were not requested.
family unix
id oval:org.mitre.oval:def:10864
status accepted
submitted 2010-07-09T03:56:16-04:00
title yum-rhn-plugin in Red Hat Enterprise Linux (RHEL) 5 does not verify the SSL certificate for a file download from a Red Hat Network (RHN) server, which makes it easier for remote man-in-the-middle attackers to cause a denial of service (loss of updates) or force the download and installation of official Red Hat packages that were not requested.
version 18
redhat via4
advisories
bugzilla
id 457113
title CVE-2008-3270 yum-rhn-plugin: does not verify SSL certificate for all communication with RHN server
oval
OR
  • comment Red Hat Enterprise Linux must be installed
    oval oval:com.redhat.rhba:tst:20070304026
  • AND
    • comment Red Hat Enterprise Linux 5 is installed
      oval oval:com.redhat.rhba:tst:20070331005
    • comment yum-rhn-plugin is earlier than 0:0.5.3-12.el5_2.9
      oval oval:com.redhat.rhsa:tst:20080815001
    • comment yum-rhn-plugin is signed with Red Hat redhatrelease key
      oval oval:com.redhat.rhsa:tst:20080815002
rhsa
id RHSA-2008:0815
released 2008-08-14
severity Moderate
title RHSA-2008:0815: yum-rhn-plugin security update (Moderate)
rpms yum-rhn-plugin-0:0.5.3-12.el5_2.9
refmap via4
bid 30695
confirm https://bugzilla.redhat.com/show_bug.cgi?id=457113
sectrack 1020698
secunia 31472
Last major update 29-09-2017 - 01:31
Published 18-08-2008 - 17:41
Last modified 29-09-2017 - 01:31
Back to Top