CVE-2008-1676

Name of the Vulnerable Software and Affected Versions Red Hat Certificate System versions 7.1 through 7.3 Netscape Certificate Management System version 6.x

Description The issue allows remote attackers to bypass intended restrictions and conduct man-in-the-middle attacks by submitting a certificate signing request (CSR) and using the resulting certificate, due to the failure to recognize Certificate Authority profile constraints on Extensions.

Recommendations For Red Hat Certificate System versions 7.1 through 7.3, consider restricting access to certificate signing requests until a fix is available. For Netscape Certificate Management System version 6.x, avoid using the affected Certificate Authority profile constraints on Extensions until the issue is resolved. As a temporary workaround, consider disabling the use of certificate signing requests in the affected systems until a patch is available.