ByteOS Network

Vulnerability Details :

CVE-2008-2420

Assigner-mitre

Assigner Org ID-8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At-23 May, 2008 | 15:00

Updated At-07 Aug, 2024 | 08:58

The OCSP functionality in stunnel before 4.24 does not properly search certificate revocation lists (CRL), which allows remote attackers to bypass intended access restrictions by using revoked certificates.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:mitre

Assigner Org ID:8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At:23 May, 2008 | 15:00

Updated At:07 Aug, 2024 | 08:58

▼CVE Numbering Authority (CNA)

Affected Products

Vendor

n/a

Product

n/a

Versions

Affected

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
http://secunia.com/advisories/30425	third-party-advisory x_refsource_SECUNIA
https://exchange.xforce.ibmcloud.com/vulnerabilities/42528	vdb-entry x_refsource_XF
https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00942.html	vendor-advisory x_refsource_FEDORA
http://www.vupen.com/english/advisories/2008/1569/references	vdb-entry x_refsource_VUPEN
http://secunia.com/advisories/30335	third-party-advisory x_refsource_SECUNIA
http://secunia.com/advisories/31438	third-party-advisory x_refsource_SECUNIA
https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00856.html	vendor-advisory x_refsource_FEDORA
http://www.mandriva.com/security/advisories?name=MDVSA-2008:168	vendor-advisory x_refsource_MANDRIVA
http://stunnel.mirt.net/pipermail/stunnel-announce/2008-May/000035.html	mailing-list x_refsource_MLIST
https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00907.html	vendor-advisory x_refsource_FEDORA
http://security.gentoo.org/glsa/glsa-200808-08.xml	vendor-advisory x_refsource_GENTOO
http://www.securityfocus.com/bid/29309	vdb-entry x_refsource_BID

Hyperlink: http://secunia.com/advisories/30425

Resource:

third-party-advisory

x_refsource_SECUNIA

Hyperlink: https://exchange.xforce.ibmcloud.com/vulnerabilities/42528

Resource:

vdb-entry

x_refsource_XF

Hyperlink: https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00942.html

Resource:

vendor-advisory

x_refsource_FEDORA

Hyperlink: http://www.vupen.com/english/advisories/2008/1569/references

Resource:

vdb-entry

x_refsource_VUPEN

Hyperlink: http://secunia.com/advisories/30335

Resource:

third-party-advisory

x_refsource_SECUNIA

Hyperlink: http://secunia.com/advisories/31438

Resource:

third-party-advisory

x_refsource_SECUNIA

Hyperlink: https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00856.html

Resource:

vendor-advisory

x_refsource_FEDORA

Hyperlink: http://www.mandriva.com/security/advisories?name=MDVSA-2008:168

Resource:

vendor-advisory

x_refsource_MANDRIVA

Hyperlink: http://stunnel.mirt.net/pipermail/stunnel-announce/2008-May/000035.html

Resource:

mailing-list

x_refsource_MLIST

Hyperlink: https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00907.html

Resource:

vendor-advisory

x_refsource_FEDORA

Hyperlink: http://security.gentoo.org/glsa/glsa-200808-08.xml

Resource:

vendor-advisory

x_refsource_GENTOO

Hyperlink: http://www.securityfocus.com/bid/29309

Resource:

vdb-entry

x_refsource_BID

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
http://secunia.com/advisories/30425	third-party-advisory x_refsource_SECUNIA x_transferred
https://exchange.xforce.ibmcloud.com/vulnerabilities/42528	vdb-entry x_refsource_XF x_transferred
https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00942.html	vendor-advisory x_refsource_FEDORA x_transferred
http://www.vupen.com/english/advisories/2008/1569/references	vdb-entry x_refsource_VUPEN x_transferred
http://secunia.com/advisories/30335	third-party-advisory x_refsource_SECUNIA x_transferred
http://secunia.com/advisories/31438	third-party-advisory x_refsource_SECUNIA x_transferred
https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00856.html	vendor-advisory x_refsource_FEDORA x_transferred
http://www.mandriva.com/security/advisories?name=MDVSA-2008:168	vendor-advisory x_refsource_MANDRIVA x_transferred
http://stunnel.mirt.net/pipermail/stunnel-announce/2008-May/000035.html	mailing-list x_refsource_MLIST x_transferred
https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00907.html	vendor-advisory x_refsource_FEDORA x_transferred
http://security.gentoo.org/glsa/glsa-200808-08.xml	vendor-advisory x_refsource_GENTOO x_transferred
http://www.securityfocus.com/bid/29309	vdb-entry x_refsource_BID x_transferred

Hyperlink: http://secunia.com/advisories/30425

Resource:

third-party-advisory

x_refsource_SECUNIA

x_transferred

Hyperlink: https://exchange.xforce.ibmcloud.com/vulnerabilities/42528

Resource:

vdb-entry

x_refsource_XF

x_transferred

Hyperlink: https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00942.html

Resource:

vendor-advisory

x_refsource_FEDORA

x_transferred

Hyperlink: http://www.vupen.com/english/advisories/2008/1569/references

Resource:

vdb-entry

x_refsource_VUPEN

x_transferred

Hyperlink: http://secunia.com/advisories/30335

Resource:

third-party-advisory

x_refsource_SECUNIA

x_transferred

Hyperlink: http://secunia.com/advisories/31438

Resource:

third-party-advisory

x_refsource_SECUNIA

x_transferred

Hyperlink: https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00856.html

Resource:

vendor-advisory

x_refsource_FEDORA

x_transferred

Hyperlink: http://www.mandriva.com/security/advisories?name=MDVSA-2008:168

Resource:

vendor-advisory

x_refsource_MANDRIVA

x_transferred

Hyperlink: http://stunnel.mirt.net/pipermail/stunnel-announce/2008-May/000035.html

Resource:

mailing-list

x_refsource_MLIST

x_transferred

Hyperlink: https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00907.html

Resource:

vendor-advisory

x_refsource_FEDORA

x_transferred

Hyperlink: http://security.gentoo.org/glsa/glsa-200808-08.xml

Resource:

vendor-advisory

x_refsource_GENTOO

x_transferred

Hyperlink: http://www.securityfocus.com/bid/29309

Resource:

vdb-entry

x_refsource_BID

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:cve@mitre.org

Published At:23 May, 2008 | 15:32

Updated At:08 Aug, 2017 | 01:31

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	2.0	6.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:P

Type: Primary

Version: 2.0

Base score: 6.8

Base severity: MEDIUM

Vector:

AV:N/AC:M/Au:N/C:P/I:P/A:P

CPE Matches

stunnel>>stunnel>>3.4a

cpe:2.3:a:stunnel:stunnel:3.4a:*:*:*:*:*:*:*

stunnel>>stunnel>>3.5

cpe:2.3:a:stunnel:stunnel:3.5:*:*:*:*:*:*:*

stunnel>>stunnel>>3.6

cpe:2.3:a:stunnel:stunnel:3.6:*:*:*:*:*:*:*

stunnel>>stunnel>>3.7

cpe:2.3:a:stunnel:stunnel:3.7:*:*:*:*:*:*:*

stunnel>>stunnel>>3.8

cpe:2.3:a:stunnel:stunnel:3.8:*:*:*:*:*:*:*

stunnel>>stunnel>>3.8p1

cpe:2.3:a:stunnel:stunnel:3.8p1:*:*:*:*:*:*:*

stunnel>>stunnel>>3.8p2

cpe:2.3:a:stunnel:stunnel:3.8p2:*:*:*:*:*:*:*

stunnel>>stunnel>>3.8p3

cpe:2.3:a:stunnel:stunnel:3.8p3:*:*:*:*:*:*:*

stunnel>>stunnel>>3.8p4

cpe:2.3:a:stunnel:stunnel:3.8p4:*:*:*:*:*:*:*

stunnel>>stunnel>>3.9

cpe:2.3:a:stunnel:stunnel:3.9:*:*:*:*:*:*:*

stunnel>>stunnel>>3.10

cpe:2.3:a:stunnel:stunnel:3.10:*:*:*:*:*:*:*

stunnel>>stunnel>>3.11

cpe:2.3:a:stunnel:stunnel:3.11:*:*:*:*:*:*:*

stunnel>>stunnel>>3.12

cpe:2.3:a:stunnel:stunnel:3.12:*:*:*:*:*:*:*

stunnel>>stunnel>>3.13

cpe:2.3:a:stunnel:stunnel:3.13:*:*:*:*:*:*:*

stunnel>>stunnel>>3.14

cpe:2.3:a:stunnel:stunnel:3.14:*:*:*:*:*:*:*

stunnel>>stunnel>>3.15

cpe:2.3:a:stunnel:stunnel:3.15:*:*:*:*:*:*:*

stunnel>>stunnel>>3.16

cpe:2.3:a:stunnel:stunnel:3.16:*:*:*:*:*:*:*

stunnel>>stunnel>>3.17

cpe:2.3:a:stunnel:stunnel:3.17:*:*:*:*:*:*:*

stunnel>>stunnel>>3.18

cpe:2.3:a:stunnel:stunnel:3.18:*:*:*:*:*:*:*

stunnel>>stunnel>>3.19

cpe:2.3:a:stunnel:stunnel:3.19:*:*:*:*:*:*:*

stunnel>>stunnel>>3.20

cpe:2.3:a:stunnel:stunnel:3.20:*:*:*:*:*:*:*

stunnel>>stunnel>>3.21

cpe:2.3:a:stunnel:stunnel:3.21:*:*:*:*:*:*:*

stunnel>>stunnel>>3.21a

cpe:2.3:a:stunnel:stunnel:3.21a:*:*:*:*:*:*:*

stunnel>>stunnel>>3.21b

cpe:2.3:a:stunnel:stunnel:3.21b:*:*:*:*:*:*:*

stunnel>>stunnel>>3.21c

cpe:2.3:a:stunnel:stunnel:3.21c:*:*:*:*:*:*:*

stunnel>>stunnel>>3.22

cpe:2.3:a:stunnel:stunnel:3.22:*:*:*:*:*:*:*

stunnel>>stunnel>>3.23

cpe:2.3:a:stunnel:stunnel:3.23:*:*:*:*:*:*:*

stunnel>>stunnel>>3.24

cpe:2.3:a:stunnel:stunnel:3.24:*:*:*:*:*:*:*

stunnel>>stunnel>>3.25

cpe:2.3:a:stunnel:stunnel:3.25:*:*:*:*:*:*:*

stunnel>>stunnel>>3.26

cpe:2.3:a:stunnel:stunnel:3.26:*:*:*:*:*:*:*

stunnel>>stunnel>>4.00

cpe:2.3:a:stunnel:stunnel:4.00:*:*:*:*:*:*:*

stunnel>>stunnel>>4.01

cpe:2.3:a:stunnel:stunnel:4.01:*:*:*:*:*:*:*

stunnel>>stunnel>>4.02

cpe:2.3:a:stunnel:stunnel:4.02:*:*:*:*:*:*:*

stunnel>>stunnel>>4.03

cpe:2.3:a:stunnel:stunnel:4.03:*:*:*:*:*:*:*

stunnel>>stunnel>>4.04

cpe:2.3:a:stunnel:stunnel:4.04:*:*:*:*:*:*:*

stunnel>>stunnel>>4.05

cpe:2.3:a:stunnel:stunnel:4.05:*:*:*:*:*:*:*

stunnel>>stunnel>>4.06

cpe:2.3:a:stunnel:stunnel:4.06:*:*:*:*:*:*:*

stunnel>>stunnel>>4.07

cpe:2.3:a:stunnel:stunnel:4.07:*:*:*:*:*:*:*

stunnel>>stunnel>>4.08

cpe:2.3:a:stunnel:stunnel:4.08:*:*:*:*:*:*:*

stunnel>>stunnel>>4.09

cpe:2.3:a:stunnel:stunnel:4.09:*:*:*:*:*:*:*

stunnel>>stunnel>>4.10

cpe:2.3:a:stunnel:stunnel:4.10:*:*:*:*:*:*:*

stunnel>>stunnel>>4.11

cpe:2.3:a:stunnel:stunnel:4.11:*:*:*:*:*:*:*

stunnel>>stunnel>>4.12

cpe:2.3:a:stunnel:stunnel:4.12:*:*:*:*:*:*:*

stunnel>>stunnel>>4.13

cpe:2.3:a:stunnel:stunnel:4.13:*:*:*:*:*:*:*

stunnel>>stunnel>>4.14

cpe:2.3:a:stunnel:stunnel:4.14:*:*:*:*:*:*:*

stunnel>>stunnel>>4.15

cpe:2.3:a:stunnel:stunnel:4.15:*:*:*:*:*:*:*

stunnel>>stunnel>>4.16

cpe:2.3:a:stunnel:stunnel:4.16:*:*:*:*:*:*:*

stunnel>>stunnel>>4.17

cpe:2.3:a:stunnel:stunnel:4.17:*:*:*:*:*:*:*

stunnel>>stunnel>>4.18

cpe:2.3:a:stunnel:stunnel:4.18:*:*:*:*:*:*:*

stunnel>>stunnel>>4.19

cpe:2.3:a:stunnel:stunnel:4.19:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-264	Primary	nvd@nist.gov

CWE ID: CWE-264

Type: Primary

Source: nvd@nist.gov

Vendor Statements

Organization : Red Hat

Last Modified : 2008-05-26T00:00:00

Not vulnerable. OCSP protocol support was only implemented in upstream stunnel version 4.16. Therefore OCSP protocol is not available in the versions of stunnel as shipped with Red Hat Enterprise Linux 2.1, 3, 4, or 5.

References

Hyperlink	Source	Resource
http://secunia.com/advisories/30335	cve@mitre.org	Vendor Advisory
http://secunia.com/advisories/30425	cve@mitre.org	N/A
http://secunia.com/advisories/31438	cve@mitre.org	N/A
http://security.gentoo.org/glsa/glsa-200808-08.xml	cve@mitre.org	N/A
http://stunnel.mirt.net/pipermail/stunnel-announce/2008-May/000035.html	cve@mitre.org	N/A
http://www.mandriva.com/security/advisories?name=MDVSA-2008:168	cve@mitre.org	N/A
http://www.securityfocus.com/bid/29309	cve@mitre.org	Patch
http://www.vupen.com/english/advisories/2008/1569/references	cve@mitre.org	N/A
https://exchange.xforce.ibmcloud.com/vulnerabilities/42528	cve@mitre.org	N/A
https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00856.html	cve@mitre.org	N/A
https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00907.html	cve@mitre.org	N/A
https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00942.html	cve@mitre.org	N/A

Hyperlink: http://secunia.com/advisories/30335

Source: cve@mitre.org

Resource:

Vendor Advisory

Hyperlink: http://secunia.com/advisories/30425

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://secunia.com/advisories/31438

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://security.gentoo.org/glsa/glsa-200808-08.xml

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://stunnel.mirt.net/pipermail/stunnel-announce/2008-May/000035.html

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://www.mandriva.com/security/advisories?name=MDVSA-2008:168

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://www.securityfocus.com/bid/29309

Source: cve@mitre.org

Resource:

Patch

Hyperlink: http://www.vupen.com/english/advisories/2008/1569/references

Source: cve@mitre.org

Resource: N/A

Hyperlink: https://exchange.xforce.ibmcloud.com/vulnerabilities/42528

Source: cve@mitre.org

Resource: N/A

Hyperlink: https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00856.html

Source: cve@mitre.org

Resource: N/A

Hyperlink: https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00907.html

Source: cve@mitre.org

Resource: N/A

Hyperlink: https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00942.html

Source: cve@mitre.org

Resource: N/A

Similar CVEs

54Records found

CVE-2007-4610

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.8||MEDIUM

EPSS-0.63% / 69.40%

7 Day CHG~0.00%

Published-31 Aug, 2007 | 00:00

Updated-07 Aug, 2024 | 15:01

Unrestricted file upload vulnerability in config/upload.php in Moonware (aka Dale Mooney Gallery) allows remote attackers to upload and execute arbitrary PHP files in images/, possibly related to config/admin.php.

Vendor-dale_mooney n/a

Product-moon_gallery n/a

CWE ID-CWE-264

Not Available

CVE-2007-3285

Matching Score-4

Assigner-Red Hat, Inc.

View Details

Matching Score-4

Assigner-Red Hat, Inc.

CVSS Score-6.8||MEDIUM

EPSS-1.76% / 81.86%

7 Day CHG~0.00%

Published-20 Jun, 2007 | 19:00

Updated-07 Aug, 2024 | 14:14

Mozilla Firefox before 2.0.0.5, when run on Windows, allows remote attackers to bypass file type checks and possibly execute programs via a (1) file:/// or (2) resource: URI with a dangerous extension, followed by a NULL byte (%00) and a safer extension, which causes Firefox to treat the requested file differently than Windows would.

Vendor-n/a Mozilla Corporation Microsoft Corporation

Product-firefox windows n/a

CWE ID-CWE-264

Not Available

CVE-2007-2108

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.8||MEDIUM

EPSS-32.86% / 96.73%

7 Day CHG~0.00%

Published-18 Apr, 2007 | 18:00

Updated-07 Aug, 2024 | 13:23

Unspecified vulnerability in the Core RDBMS component in Oracle Database 9.0.1.5, 9.2.0.8, 10.1.0.5, and 10.2.0.2 on Windows allows remote attackers to have an unknown impact, aka DB01. NOTE: as of 20070424, Oracle has not disputed reliable claims that this issue occurs because the NTLM SSPI AcceptSecurityContext function grants privileges based on the username provided even though all users are authenticated as Guest, which allows remote attackers to gain privileges.

Vendor-n/a Microsoft Corporation Oracle Corporation

Product-windows database_server n/a

CWE ID-CWE-264

Not Available

CVE-2007-4403

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.8||MEDIUM

EPSS-1.92% / 82.58%

7 Day CHG~0.00%

Published-18 Aug, 2007 | 21:00

Updated-07 Aug, 2024 | 14:53

The mIRC Control Plug-in for Winamp allows user-assisted remote attackers to execute arbitrary code via the '|' (pipe) shell metacharacter in the name of the song in a .mp3 file.

Vendor-mirc n/a

Product-plug-in_for_winamp n/a

CWE ID-CWE-264

Not Available

CVE-2008-2420

Credits

Vendors

Products

Metrics (CVSS)

Weaknesses

Attack Patterns

Solution/Workaround

References

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

Stakeholder-Specific Vulnerability Categorization (SSVC)

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History

Similar CVEs