CVE-2010-3868

Red Hat Certificate System (RHCS) 7.3 and 8 and Dogtag Certificate System do not require authentication for requests to decrypt SCEP one-time PINs, which allows remote attackers to obtain PINs by sniffing the network for SCEP requests and then sending decryption requests to the Certificate Authority component.

Score

CVSS 2.0 5.8 Medium

Status

Modified - secalert@redhat.com

Published

2010-11-17

Last modified

2024-08-07

Weaknesses

CWE-287

Affected products

• Certificate System (Redhat)
• Dogtag Certificate System (Redhat)

References

• http://secunia.com/advisories/42181
• http://securitytracker.com/id?1024697
• http://www.osvdb.org/69149
• https://bugzilla.redhat.com/show_bug.cgi?id=648882
• https://fedorahosted.org/pki/changeset/1261
• https://rhn.redhat.com/errata/RHSA-2010-0837.html
• https://rhn.redhat.com/errata/RHSA-2010-0838.html