CVE-2012-4555 - The token processing system (pki-tps) in Red Hat Certificate System (RHCS) before 8.1.3 does not pro

CVE-2012-4555

Summary

The token processing system (pki-tps) in Red Hat Certificate System (RHCS) before 8.1.3 does not properly handle interruptions of token format operations, which allows remote attackers to cause a denial of service (NULL pointer dereference and Apache httpd web server child process crash) via unspecified vectors.

References

Vulnerable Configurations

cpe:2.3:a:redhat:certificate_system:7.1:*:*:*:*:*:*:*
cpe:2.3:a:redhat:certificate_system:7.1:*:*:*:*:*:*:*
cpe:2.3:a:redhat:certificate_system:7.2:*:*:*:*:*:*:*
cpe:2.3:a:redhat:certificate_system:7.2:*:*:*:*:*:*:*
cpe:2.3:a:redhat:certificate_system:7.3:*:*:*:*:*:*:*
cpe:2.3:a:redhat:certificate_system:7.3:*:*:*:*:*:*:*
cpe:2.3:a:redhat:certificate_system:8:*:*:*:*:*:*:*
cpe:2.3:a:redhat:certificate_system:8:*:*:*:*:*:*:*
cpe:2.3:a:redhat:certificate_system:8.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:certificate_system:8.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:certificate_system:8.1:*:*:*:*:*:*:*
cpe:2.3:a:redhat:certificate_system:8.1:*:*:*:*:*:*:*
cpe:2.3:a:redhat:certificate_system:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:certificate_system:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:certificate_system:8.1.1:*:*:*:*:*:*:*
cpe:2.3:a:redhat:certificate_system:8.1.1:*:*:*:*:*:*:*

CVSS

Base:	4.0 (as of 07-01-2013 - 15:41)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	SINGLE

Impact

Confidentiality	Integrity	Availability
NONE	NONE	PARTIAL

cvss-vector via4

AV:N/AC:L/Au:S/C:N/I:N/A:P

redhat via4

advisories

rhsa

id	RHSA-2012:1550

rpms

pki-common-0:8.1.3-2.el5pki
pki-common-javadoc-0:8.1.3-2.el5pki
pki-tps-0:8.1.3-2.el5pki

refmap via4

bid	56843
misc	https://bugzilla.redhat.com/show_bug.cgi?id=869570
sectrack	1027846
secunia	51482

Last major update

07-01-2013 - 15:41

Published

04-01-2013 - 22:55

Last modified

07-01-2013 - 15:41