Bug 448290 (CVE-2008-2420) - CVE-2008-2420 stunnel: incorrect CRL verification using OCSP protocol
Summary: CVE-2008-2420 stunnel: incorrect CRL verification using OCSP protocol
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2008-2420
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL: http://nvd.nist.gov/nvd.cfm?cvename=C...
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2008-05-25 13:49 UTC by Tomas Hoger
Modified: 2019-09-29 12:24 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2008-06-19 10:54:36 UTC


Attachments (Terms of Use)
Error report when applying stunnel update (124.08 KB, image/png)
2008-05-31 17:20 UTC, Raymond Hankins
no flags Details

Description Tomas Hoger 2008-05-25 13:49:22 UTC
Common Vulnerabilities and Exposures assigned an identifier CVE-2008-2420 to the following vulnerability:

The OCSP functionality in stunnel before 4.24 does not properly search
certificate revocation lists (CRL), which allows remote attackers to
bypass intended access restrictions by using revoked certificates.

References:
http://stunnel.mirt.net/pipermail/stunnel-announce/2008-May/000035.html
http://www.securityfocus.com/bid/29309
http://www.frsirt.com/english/advisories/2008/1569
http://secunia.com/advisories/30335
http://xforce.iss.net/xforce/xfdb/42528

Comment 1 Tomas Hoger 2008-05-25 13:53:16 UTC
This issue does not affect versions of stunnel as shipped in Red Hat Enterprise
Linux 2.1, 3, 4 and 5.  Support for OCSP protocol was only implemented in
version 4.16, all Red Hat Enterprise Linux versions ship older stunnel versions,
which do not support OCSP protocol.

http://stunnel.mirt.net/ChangeLog_sdf.html

Version 4.16, 2006.08.31, urgency: MEDIUM:

  * New features sponsored by Hewlett-Packard
     [ ... ]
     o OCSP support: ocsp = <URL>



Comment 2 Fedora Update System 2008-05-25 13:57:46 UTC
stunnel-4.24-0.fc7 has been submitted as an update for Fedora 7

Comment 3 Fedora Update System 2008-05-25 13:58:41 UTC
stunnel-4.24-0.fc8 has been submitted as an update for Fedora 8

Comment 4 Fedora Update System 2008-05-25 13:59:04 UTC
stunnel-4.24-1.fc9 has been submitted as an update for Fedora 9

Comment 5 Fedora Update System 2008-05-29 02:44:04 UTC
stunnel-4.24-1.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Fedora Update System 2008-05-29 02:47:19 UTC
stunnel-4.24-0.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 7 Fedora Update System 2008-05-29 02:49:22 UTC
stunnel-4.24-0.fc7 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 8 Raymond Hankins 2008-05-31 17:20:26 UTC
Created attachment 307284 [details]
Error report when applying stunnel update

Comment 9 Tomas Hoger 2008-05-31 19:50:01 UTC
(In reply to comment #8)
> Error report when applying stunnel update

Raymond, if you believe your problem is really caused by stunnel update, please
open a separate bug report against specific Fedora version with further details.
 Your screenshot does not provide enough information and there's no suggestion
there that the problem is caused by stunnel.

Thanks!


Note You need to log in before you can comment on or make changes to this bug.