CVE-2008-5077

CVE Details

Release Date:

2009-01-07

Description

OpenSSL 0.9.8i and earlier does not properly check the return value from the EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys. BIND 9.6.0, 9.5.1, 9.5.0, 9.4.3, and earlier does not properly check the return value from the OpenSSL DSA_verify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077. Evolution 2.22.3.1 checks S/MIME signatures against a copy of the e-mail text within a signed-data blob, not the copy of the e-mail text displayed to the user, which allows remote attackers to spoof a signature by modifying the latter copy, a different vulnerability than CVE-2008-5077. NTP 4.2.4 before 4.2.4p5 and 4.2.5 before 4.2.5p150 does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys, a similar vulnerability to CVE-2008-5077.

See more information about CVE-2008-5077 from MITRE CVE dictionary and NIST NVD

CVSS v2.0 metrics

NOTE: The following CVSS v2.0 metrics and score provided are preliminary and subject to review.

Base Score:	5.8	Base Metrics:	AV:N/AC:M/Au:N/C:N/I:P/A:P
Access Vector:	Network	Attack Complexity:	Medium
Authentication:	None required	Confidentiality Impact:	None
Integrity Impact:	Partial	Availability Impact:	Partial

Errata information

Platform	Errata	Release Date
Oracle Enterprise Linux version 3 (openssl)	ELSA-2009-0004	2009-01-07
Oracle Enterprise Linux version 3 (openssl096b)	ELSA-2009-0004	2009-01-07
Oracle Enterprise Linux version 4 (openssl)	ELSA-2009-0004	2009-01-07
Oracle Enterprise Linux version 4 (openssl096b)	ELSA-2009-0004	2009-01-07
Oracle Linux version 5 (openssl)	ELSA-2009-0004	2009-01-07
Oracle Linux version 5 (openssl097a)	ELSA-2009-0004	2009-01-07

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team