Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Certificate System (RHCS) before 8.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) pageStart or (2) pageSize to the displayCRL script, or (3) nonce variable to the profileProcess script.

Updated pki-common and pki-tps packages that fix multiple security issues are now available for Red Hat Certificate System 8.1.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Red Hat Certificate System (RHCS) is an enterprise software system designed to manage enterprise Public Key Infrastructure (PKI) deployments.

Multiple cross-site scripting flaws were discovered in the Red Hat Certificate System. An attacker could use these flaws to perform a cross-site scripting (XSS) attack against victims using Certificate System's web interface. (CVE-2012-4543)

Multiple denial of service flaws were found in the Red Hat Certificate System token processing. A Certificate System user could use these flaws to crash the Apache httpd web server child process, possibly interrupting the processing of other users' requests. (CVE-2012-4555, CVE-2012-4556)

Red Hat would like to thank Patrick Raspante and Ryan Millay of GDC4S for reporting the CVE-2012-4555 and CVE-2012-4556 issues.

All users of Red Hat Certificate System are advised to upgrade to these updated packages, which correct these issues. After installing this update, all Red Hat Certificate System subsystems must be restarted ('/etc/init.d /[instance-name] restart') for the update to take effect.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2013-0511 advisory.

    [9.0.3-30]
    - Resolves #902474 - upgrading IPA from 2.2 to 3.0 sees certmonger errors

    [9.0.3-29]
    - Resolves #891985 - Increase FreeIPA root CA validity

    [9.0.3-28]
    - Resolves #885790 - Multiple cross-site scripting flaws       by displaying CRL or processing profile

    [9.0.3-27]
    - Resolves #867640 - ipa-replica-install Configuration of CA failed       by REVERTING #819111 - Non-existent container breaks replication

    [9.0.3-26]
    - Resolves #844459 - Increase audit cert renewal range to 2 years (mharmsen)
    - Resolves #841663 - serial number incorrectly cast from BigInt to integer in       installation wizard (mharmsen)
    - Resolves #858864 - create/ identify a mechanism for clients to determine that       the pki subsystem is up (alee)

    [9.0.3-25]
    - Resolves #819111 - Non-existent container breaks replication

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated pki-core packages that fix multiple security issues, two bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Red Hat Certificate System is an enterprise software system designed to manage enterprise public key infrastructure (PKI) deployments. PKI Core contains fundamental packages required by Red Hat Certificate System, which comprise the Certificate Authority (CA) subsystem.

Note: The Certificate Authority component provided by this advisory cannot be used as a standalone server. It is installed and operates as a part of Identity Management (the IPA component) in Red Hat Enterprise Linux.

Multiple cross-site scripting flaws were discovered in Certificate System. An attacker could use these flaws to perform a cross-site scripting (XSS) attack against victims using Certificate System's web interface. (CVE-2012-4543)

This update also fixes the following bugs :

* Previously, due to incorrect conversion of large integers while generating a new serial number, some of the most significant bits in the serial number were truncated. Consequently, the serial number generated for certificates was sometimes smaller than expected and this incorrect conversion in turn led to a collision if a certificate with the smaller number already existed in the database. This update removes the incorrect integer conversion so that no serial numbers are truncated. As a result, the installation wizard proceeds as expected.
(BZ#841663)

* The certificate authority used a different profile for issuing the audit certificate than it used for renewing it. The issuing profile was for two years, and the renewal was for six months. They should both be for two years. This update sets the default and constraint parameters in the caSignedLogCert.cfg audit certificate renewal profile to two years. (BZ#844459)

This update also adds the following enhancements :

* IPA (Identity, Policy and Audit) now provides an improved way to determine that PKI is up and ready to service requests. Checking the service status was not sufficient. This update creates a mechanism for clients to determine that the PKI subsystem is up using the getStatus() function to query the cs.startup_state in CS.cfg.
(BZ#858864)

* This update increases the default root CA validity period from eight years to twenty years. (BZ#891985)

All users of pki-core are advised to upgrade to these updated packages, which fix these issues and add these enhancements.

Note: The Certificate Authority component provided by this advisory cannot be used as a standalone server. It is installed and operates as a part of Identity Management (the IPA component) in Scientific Linux.

Multiple cross-site scripting flaws were discovered in Certificate System. An attacker could use these flaws to perform a cross-site scripting (XSS) attack against victims using Certificate System's web interface. (CVE-2012-4543)

This update also fixes the following bugs :

  - Previously, due to incorrect conversion of large     integers while generating a new serial number, some of     the most significant bits in the serial number were     truncated. Consequently, the serial number generated for     certificates was sometimes smaller than expected and     this incorrect conversion in turn led to a collision if     a certificate with the smaller number already existed in     the database. This update removes the incorrect integer     conversion so that no serial numbers are truncated. As a     result, the installation wizard proceeds as expected.

  - The certificate authority used a different profile for     issuing the audit certificate than it used for renewing     it. The issuing profile was for two years, and the     renewal was for six months. They should both be for two     years. This update sets the default and constraint     parameters in the caSignedLogCert.cfg audit certificate     renewal profile to two years.

This update also adds the following enhancements :

  - IPA (Identity, Policy and Audit) now provides an     improved way to determine that PKI is up and ready to     service requests. Checking the service status was not     sufficient. This update creates a mechanism for clients     to determine that the PKI subsystem is up using the     getStatus() function to query the cs.startup_state in     CS.cfg.

  - This update increases the default root CA validity     period from eight years to twenty years.

Bugzilla Bug #884829 - Multiple cross-site scripting flaws

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes the following CVE :

CVE-2012-4543 Certificate System: Multiple cross-site scripting flaws by displaying CRL or processing profile

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
78943	RHEL 5 : pki (RHSA-2012:1550)	Nessus	Red Hat Local Security Checks	medium
68749	Oracle Linux 6 : pki-core (ELSA-2013-0511)	Nessus	Oracle Linux Local Security Checks	medium
65144	CentOS 6 : pki-core (CESA-2013:0511)	Nessus	CentOS Local Security Checks	medium
64958	Scientific Linux Security Update : pki-core on SL6.x i386/x86_64 (20130221)	Nessus	Scientific Linux Local Security Checks	medium
64760	RHEL 6 : pki-core (RHSA-2013:0511)	Nessus	Red Hat Local Security Checks	medium
63329	Fedora 16 : pki-core-9.0.25-1.fc16 (2012-20243)	Nessus	Fedora Local Security Checks	medium
63278	Fedora 17 : pki-core-9.0.25-1.fc17 (2012-20220)	Nessus	Fedora Local Security Checks	medium
63216	Fedora 18 : pki-core-10.0.0-2.fc18 (2012-20121)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2012-4543

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium