NVD Vulnerability Detail

CVE-2008-5077

Summary	OpenSSL 0.9.8i and earlier does not properly check the return value from the EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys.
Publication Date	Jan. 8, 2009, 2:30 a.m.
Registration Date	Jan. 29, 2021, 1:45 p.m.
Last Update	Oct. 12, 2018, 5:53 a.m.

CVSS2.0 : MEDIUM
Score	5.8
Vector	AV:N/AC:M/Au:N/C:N/I:P/A:P
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	中
攻撃前の認証要否(Au)	不要
機密性への影響(C)	なし
完全性への影響(I)	低
可用性への影響(A)	低
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	いいえ

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:openssl:openssl:0.9.1c:::::::*
cpe:2.3:a:openssl:openssl:0.9.2b:::::::*
cpe:2.3:a:openssl:openssl:0.9.3:::::::*
cpe:2.3:a:openssl:openssl:0.9.3a:::::::*
cpe:2.3:a:openssl:openssl:0.9.4:::::::*
cpe:2.3:a:openssl:openssl:0.9.5:::::::*
cpe:2.3:a:openssl:openssl:0.9.5:beta1::::::
cpe:2.3:a:openssl:openssl:0.9.5:beta2::::::
cpe:2.3:a:openssl:openssl:0.9.5a:::::::*
cpe:2.3:a:openssl:openssl:0.9.5a:beta1::::::
cpe:2.3:a:openssl:openssl:0.9.5a:beta2::::::
cpe:2.3:a:openssl:openssl:0.9.6:::::::*
cpe:2.3:a:openssl:openssl:0.9.6:beta1::::::
cpe:2.3:a:openssl:openssl:0.9.6:beta2::::::
cpe:2.3:a:openssl:openssl:0.9.6:beta3::::::
cpe:2.3:a:openssl:openssl:0.9.6a:::::::*
cpe:2.3:a:openssl:openssl:0.9.6a:beta1::::::
cpe:2.3:a:openssl:openssl:0.9.6a:beta2::::::
cpe:2.3:a:openssl:openssl:0.9.6a:beta3::::::
cpe:2.3:a:openssl:openssl:0.9.6b:::::::*
cpe:2.3:a:openssl:openssl:0.9.6c:::::::*
cpe:2.3:a:openssl:openssl:0.9.6d:::::::*
cpe:2.3:a:openssl:openssl:0.9.6e:::::::*
cpe:2.3:a:openssl:openssl:0.9.6f:::::::*
cpe:2.3:a:openssl:openssl:0.9.6g:::::::*
cpe:2.3:a:openssl:openssl:0.9.6h:::::::*
cpe:2.3:a:openssl:openssl:0.9.6i:::::::*
cpe:2.3:a:openssl:openssl:0.9.6j:::::::*
cpe:2.3:a:openssl:openssl:0.9.6k:::::::*
cpe:2.3:a:openssl:openssl:0.9.6l:::::::*
cpe:2.3:a:openssl:openssl:0.9.6m:::::::*
cpe:2.3:a:openssl:openssl:0.9.7:::::::*
cpe:2.3:a:openssl:openssl:0.9.7:beta1::::::
cpe:2.3:a:openssl:openssl:0.9.7:beta2::::::
cpe:2.3:a:openssl:openssl:0.9.7:beta3::::::
cpe:2.3:a:openssl:openssl:0.9.7:beta4::::::
cpe:2.3:a:openssl:openssl:0.9.7:beta5::::::
cpe:2.3:a:openssl:openssl:0.9.7:beta6::::::
cpe:2.3:a:openssl:openssl:0.9.7a:::::::*
cpe:2.3:a:openssl:openssl:0.9.7b:::::::*
cpe:2.3:a:openssl:openssl:0.9.7c:::::::*
cpe:2.3:a:openssl:openssl:0.9.7d:::::::*
cpe:2.3:a:openssl:openssl:0.9.7e:::::::*
cpe:2.3:a:openssl:openssl:0.9.7f:::::::*
cpe:2.3:a:openssl:openssl:0.9.7g:::::::*
cpe:2.3:a:openssl:openssl:0.9.7h:::::::*
cpe:2.3:a:openssl:openssl:0.9.7i:::::::*
cpe:2.3:a:openssl:openssl:0.9.7j:::::::*
cpe:2.3:a:openssl:openssl:0.9.7k:::::::*
cpe:2.3:a:openssl:openssl:0.9.7l:::::::*
cpe:2.3:a:openssl:openssl:0.9.8:::::::*
cpe:2.3:a:openssl:openssl:0.9.8a:::::::*
cpe:2.3:a:openssl:openssl:0.9.8b:::::::*
cpe:2.3:a:openssl:openssl:0.9.8c:::::::*
cpe:2.3:a:openssl:openssl:0.9.8d:::::::*
cpe:2.3:a:openssl:openssl:0.9.8e:::::::*
cpe:2.3:a:openssl:openssl:0.9.8f:::::::*
cpe:2.3:a:openssl:openssl:0.9.8g:::::::*
cpe:2.3:a:openssl:openssl::::::::		0.9.8h

Related information, measures and tools

No	URL	refsource	タグ
1	http://lists.apple.com/archives/security-announce/2009/May/msg00002.html	APPLE
2	http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00013.html	SUSE
3	http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00014.html	SUSE
4	http://marc.info/?l=bugtraq&m=123859864430555&w=2	HP
5	http://marc.info/?l=bugtraq&m=124277349419254&w=2	HP
6	http://marc.info/?l=bugtraq&m=127678688104458&w=2	HP
7	http://secunia.com/advisories/33338	SECUNIA	Vendor Advisory
8	http://secunia.com/advisories/33394	SECUNIA
9	http://secunia.com/advisories/33436	SECUNIA	Vendor Advisory
10	http://secunia.com/advisories/33557	SECUNIA	Vendor Advisory
11	http://secunia.com/advisories/33673	SECUNIA	Vendor Advisory
12	http://secunia.com/advisories/33765	SECUNIA	Vendor Advisory
13	http://secunia.com/advisories/34211	SECUNIA	Vendor Advisory
14	http://secunia.com/advisories/35074	SECUNIA	Vendor Advisory
15	http://secunia.com/advisories/35108	SECUNIA	Vendor Advisory
16	http://secunia.com/advisories/39005	SECUNIA	Vendor Advisory
17	http://security.gentoo.org/glsa/glsa-200902-02.xml	GENTOO
18	http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.544796	SLACKWARE
19	http://sunsolve.sun.com/search/document.do?assetkey=1-66-250826-1	SUNALERT
20	http://support.apple.com/kb/HT3549	CONFIRM
21	http://support.avaya.com/elmodocs2/security/ASA-2009-038.htm	CONFIRM
22	http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=837653	CONFIRM
23	http://voodoo-circle.sourceforge.net/sa/sa-20090123-01.html	CONFIRM
24	http://www.ocert.org/advisories/ocert-2008-016.html	MISC
25	http://www.openssl.org/news/secadv_20090107.txt	CONFIRM
26	http://www.redhat.com/support/errata/RHSA-2009-0004.html	REDHAT
27	http://www.securityfocus.com/archive/1/499827/100/0/threaded	BUGTRAQ
28	http://www.securityfocus.com/archive/1/502322/100/0/threaded	BUGTRAQ
29	http://www.securityfocus.com/bid/33150	BID
30	http://www.securitytracker.com/id?1021523	SECTRACK
31	http://www.us-cert.gov/cas/techalerts/TA09-133A.html	CERT	US Government Resource
32	http://www.vmware.com/security/advisories/VMSA-2009-0004.html	CONFIRM
33	http://www.vupen.com/english/advisories/2009/0040	VUPEN	Vendor Advisory
34	http://www.vupen.com/english/advisories/2009/0289	VUPEN	Vendor Advisory
35	http://www.vupen.com/english/advisories/2009/0362	VUPEN	Vendor Advisory
36	http://www.vupen.com/english/advisories/2009/0558	VUPEN	Vendor Advisory
37	http://www.vupen.com/english/advisories/2009/0904	VUPEN	Vendor Advisory
38	http://www.vupen.com/english/advisories/2009/0913	VUPEN	Vendor Advisory
39	http://www.vupen.com/english/advisories/2009/1297	VUPEN	Vendor Advisory
40	http://www.vupen.com/english/advisories/2009/1338	VUPEN	Vendor Advisory
41	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6380	OVAL
42	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9155	OVAL
43	https://usn.ubuntu.com/704-1/	UBUNTU

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-20	不適切な入力確認	https://cwe.mitre.org/data/definitions/20.html

JVN Vulnerability Information

OpenSSL における証明書チェーンの有効性を回避される脆弱性

Title	OpenSSL における証明書チェーンの有効性を回避される脆弱性
Summary	OpenSSL には、EVP_VerifyFinal 関数からの戻り値が正しくチェックされないため、証明書チェーンの有効性を回避される脆弱性が存在します。
Possible impacts	リモートの攻撃者により、DSA および ECDSA 鍵用の不正な SSL/TLS 署名を介して、証明書チェーンの有効性を回避される可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Jan. 7, 2009, midnight
Registration Date	July 8, 2009, 11:13 a.m.
Last Update	Oct. 1, 2012, 5:07 p.m.

Affected System

サン・マイクロシステムズ

OpenSolaris (sparc)

OpenSolaris (x86)

Sun Solaris 10 (sparc)

Sun Solaris 10 (x86)

ヒューレット・パッカード

HP-UX 11.11

HP-UX 11.23

HP-UX 11.31

OpenSSL Project

OpenSSL 0.9.8i およびそれ以前

ターボリナックス

Turbolinux Appliance Server 1.0 (workgroup)

Turbolinux Appliance Server 2.0

Turbolinux Appliance Server 1.0 (hosting)

Turbolinux Client 2008

Turbolinux FUJI

Turbolinux Multimedia

Turbolinux Personal

Turbolinux Server 10

Turbolinux Server 10 (x64)

Turbolinux Server 11

Turbolinux Server 11 (x64)

Turbolinux Server 8

wizpy

サイバートラスト株式会社

Asianux Server 3 (x86)

Asianux Server 3 (x86-64)

Asianux Server 3.0

Asianux Server 3.0 (x86-64)

Asianux Server 4.0

Asianux Server 4.0 (x86-64)

アップル

Apple Mac OS X v10.4.11

Apple Mac OS X v10.5 から v10.5.6

Apple Mac OS X Server v10.4.11

Apple Mac OS X Server v10.5 から v10.5.6

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2008-5077	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5077
National Vulnerability Database (NVD)
2	CVE-2008-5077	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-5077

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-287	https://jvndb.jvn.jp/ja/cwe/CWE-287.html

ベンダー情報

No	Name	URL
Apple Security Updates
1	HT3549	http://support.apple.com/kb/HT3549
Apple セキュリティアップデート
2	HT3549	http://support.apple.com/kb/HT3549?viewlocale=ja_JP
Asianux Technical Support Network
3	openssl-0.9.8b-10.1AXS3.1	https://tsn.miraclelinux.com/tsn_local/index.php?m=errata&a=detail&eid=401
4	openssl097a-0.9.7a-9AXS3.1	https://tsn.miraclelinux.com/tsn_local/index.php?m=errata&a=detail&eid=400
HP Security Bulletin
5	HPSBUX02418	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01706219
MIRACLE LINUX アップデート情報
6	1655	http://www.miraclelinux.com/support/index.php?q=node/99&errata_id=1655
7	1669	http://www.miraclelinux.com/support/index.php?q=node/99&errata_id=1669
8	1933	http://www.miraclelinux.com/support/index.php?q=node/99&errata_id=1933
OpenSSL
9	Top Page	http://www.openssl.org/
SECURITY BLOG
10	Multiple OpenSSL vulnerabilities in Sun SPARC Enterprise M-series XCP Firmware	https://blogs.oracle.com/sunsecurity/entry/multiple_openssl_vulnerabilities_in_sun
Sun Alert Notification
11	250826	http://sunsolve.sun.com/search/document.do?assetkey=1-66-250826-1
Turbolinux Security Advisory (英語)
12	TLSA-2009-5	http://www.turbolinux.com/security/2009/TLSA-2009-5.txt
製品セキュリティ情報
13	TLSA-2009-5	http://www.turbolinux.co.jp/security/2009/TLSA-2009-5j.txt

その他

No	Name	URL
Secunia Advisory
1	SA33338	http://secunia.com/advisories/33338/
SecurityFocus
2	33150	http://www.securityfocus.com/bid/33150
3	33151	http://www.securityfocus.com/bid/33151
VUPEN Security
4	VUPEN/ADV-2009-0913	http://www.vupen.com/english/advisories/2009/0913

Change Log

No	Changed Details	Date of change
0	[2009年07月08日] 掲載 [2010年02月15日] ベンダ情報：ミラクル・リナックス (1933) を追加 [2012年10月01日] ベンダ情報：オラクル (Multiple OpenSSL vulnerabilities in Sun SPARC Enterprise M-series XCP Firmware) を追加	Feb. 17, 2018, 10:37 a.m.

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:openssl:openssl:0.9.1c:::::::*
cpe:2.3:a:openssl:openssl:0.9.2b:::::::*
cpe:2.3:a:openssl:openssl:0.9.3:::::::*
cpe:2.3:a:openssl:openssl:0.9.3a:::::::*
cpe:2.3:a:openssl:openssl:0.9.4:::::::*
cpe:2.3:a:openssl:openssl:0.9.5:::::::*
cpe:2.3:a:openssl:openssl:0.9.5:beta1::::::
cpe:2.3:a:openssl:openssl:0.9.5:beta2::::::
cpe:2.3:a:openssl:openssl:0.9.5a:::::::*
cpe:2.3:a:openssl:openssl:0.9.5a:beta1::::::
cpe:2.3:a:openssl:openssl:0.9.5a:beta2::::::
cpe:2.3:a:openssl:openssl:0.9.6:::::::*
cpe:2.3:a:openssl:openssl:0.9.6:beta1::::::
cpe:2.3:a:openssl:openssl:0.9.6:beta2::::::
cpe:2.3:a:openssl:openssl:0.9.6:beta3::::::
cpe:2.3:a:openssl:openssl:0.9.6a:::::::*
cpe:2.3:a:openssl:openssl:0.9.6a:beta1::::::
cpe:2.3:a:openssl:openssl:0.9.6a:beta2::::::
cpe:2.3:a:openssl:openssl:0.9.6a:beta3::::::
cpe:2.3:a:openssl:openssl:0.9.6b:::::::*
cpe:2.3:a:openssl:openssl:0.9.6c:::::::*
cpe:2.3:a:openssl:openssl:0.9.6d:::::::*
cpe:2.3:a:openssl:openssl:0.9.6e:::::::*
cpe:2.3:a:openssl:openssl:0.9.6f:::::::*
cpe:2.3:a:openssl:openssl:0.9.6g:::::::*
cpe:2.3:a:openssl:openssl:0.9.6h:::::::*
cpe:2.3:a:openssl:openssl:0.9.6i:::::::*
cpe:2.3:a:openssl:openssl:0.9.6j:::::::*
cpe:2.3:a:openssl:openssl:0.9.6k:::::::*
cpe:2.3:a:openssl:openssl:0.9.6l:::::::*
cpe:2.3:a:openssl:openssl:0.9.6m:::::::*
cpe:2.3:a:openssl:openssl:0.9.7:::::::*
cpe:2.3:a:openssl:openssl:0.9.7:beta1::::::
cpe:2.3:a:openssl:openssl:0.9.7:beta2::::::
cpe:2.3:a:openssl:openssl:0.9.7:beta3::::::
cpe:2.3:a:openssl:openssl:0.9.7:beta4::::::
cpe:2.3:a:openssl:openssl:0.9.7:beta5::::::
cpe:2.3:a:openssl:openssl:0.9.7:beta6::::::
cpe:2.3:a:openssl:openssl:0.9.7a:::::::*
cpe:2.3:a:openssl:openssl:0.9.7b:::::::*
cpe:2.3:a:openssl:openssl:0.9.7c:::::::*
cpe:2.3:a:openssl:openssl:0.9.7d:::::::*
cpe:2.3:a:openssl:openssl:0.9.7e:::::::*
cpe:2.3:a:openssl:openssl:0.9.7f:::::::*
cpe:2.3:a:openssl:openssl:0.9.7g:::::::*
cpe:2.3:a:openssl:openssl:0.9.7h:::::::*
cpe:2.3:a:openssl:openssl:0.9.7i:::::::*
cpe:2.3:a:openssl:openssl:0.9.7j:::::::*
cpe:2.3:a:openssl:openssl:0.9.7k:::::::*
cpe:2.3:a:openssl:openssl:0.9.7l:::::::*
cpe:2.3:a:openssl:openssl:0.9.8:::::::*
cpe:2.3:a:openssl:openssl:0.9.8a:::::::*
cpe:2.3:a:openssl:openssl:0.9.8b:::::::*
cpe:2.3:a:openssl:openssl:0.9.8c:::::::*
cpe:2.3:a:openssl:openssl:0.9.8d:::::::*
cpe:2.3:a:openssl:openssl:0.9.8e:::::::*
cpe:2.3:a:openssl:openssl:0.9.8f:::::::*
cpe:2.3:a:openssl:openssl:0.9.8g:::::::*
cpe:2.3:a:openssl:openssl::::::::		0.9.8h