CVE-2008-5077

Published: Jan 7, 2009Modified: Apr 23, 2026

5.8

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:P

Exploitability: 8.6 / Impact: 4.9

Source: NVD

Description

OpenSSL 0.9.8i and earlier does not properly check the return value from the EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys.

Affected (59)

Products: Openssl: Openssl

Openssl

1 product

Openssl

Configuration A

59 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	Up to 0.9.8h
Openssl Openssl	Version 0.9.1c
Openssl Openssl	Version 0.9.2b
Openssl Openssl	Version 0.9.3
Openssl Openssl	Version 0.9.3a
Openssl Openssl	Version 0.9.4
Openssl Openssl	Version 0.9.5
Openssl Openssl	Version 0.9.5 beta1
Openssl Openssl	Version 0.9.5 beta2
Openssl Openssl	Version 0.9.5a
Openssl Openssl	Version 0.9.5a beta1
Openssl Openssl	Version 0.9.5a beta2
Openssl Openssl	Version 0.9.6
Openssl Openssl	Version 0.9.6 beta1
Openssl Openssl	Version 0.9.6 beta2
Openssl Openssl	Version 0.9.6 beta3
Openssl Openssl	Version 0.9.6a
Openssl Openssl	Version 0.9.6a beta1
Openssl Openssl	Version 0.9.6a beta2
Openssl Openssl	Version 0.9.6a beta3
Openssl Openssl	Version 0.9.6b
Openssl Openssl	Version 0.9.6c
Openssl Openssl	Version 0.9.6d
Openssl Openssl	Version 0.9.6e
Openssl Openssl	Version 0.9.6f
Openssl Openssl	Version 0.9.6g
Openssl Openssl	Version 0.9.6h
Openssl Openssl	Version 0.9.6i
Openssl Openssl	Version 0.9.6j
Openssl Openssl	Version 0.9.6k
Openssl Openssl	Version 0.9.6l
Openssl Openssl	Version 0.9.6m
Openssl Openssl	Version 0.9.7
Openssl Openssl	Version 0.9.7 beta1
Openssl Openssl	Version 0.9.7 beta2
Openssl Openssl	Version 0.9.7 beta3
Openssl Openssl	Version 0.9.7 beta4
Openssl Openssl	Version 0.9.7 beta5
Openssl Openssl	Version 0.9.7 beta6
Openssl Openssl	Version 0.9.7a
Openssl Openssl	Version 0.9.7b
Openssl Openssl	Version 0.9.7c
Openssl Openssl	Version 0.9.7d
Openssl Openssl	Version 0.9.7e
Openssl Openssl	Version 0.9.7f
Openssl Openssl	Version 0.9.7g
Openssl Openssl	Version 0.9.7h
Openssl Openssl	Version 0.9.7i
Openssl Openssl	Version 0.9.7j
Openssl Openssl	Version 0.9.7k
Openssl Openssl	Version 0.9.7l
Openssl Openssl	Version 0.9.8
Openssl Openssl	Version 0.9.8a
Openssl Openssl	Version 0.9.8b
Openssl Openssl	Version 0.9.8c
Openssl Openssl	Version 0.9.8d
Openssl Openssl	Version 0.9.8e
Openssl Openssl	Version 0.9.8f
Openssl Openssl	Version 0.9.8g

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (86)

http://lists.apple.com/archives/security-announce/2009/May/msg00002.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00013.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00014.html

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=123859864430555&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=124277349419254&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=127678688104458&w=2

Source: secalert@redhat.com

http://secunia.com/advisories/33338

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/33394

Source: secalert@redhat.com

http://secunia.com/advisories/33436

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/33557

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/33673

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/33765

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/34211

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/35074

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/35108

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/39005

Source: secalert@redhat.com

Vendor Advisory

http://security.gentoo.org/glsa/glsa-200902-02.xml

Source: secalert@redhat.com

http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.544796

Source: secalert@redhat.com

http://sunsolve.sun.com/search/document.do?assetkey=1-66-250826-1

Source: secalert@redhat.com

http://support.apple.com/kb/HT3549

Source: secalert@redhat.com

http://support.avaya.com/elmodocs2/security/ASA-2009-038.htm

Source: secalert@redhat.com

http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=837653

Source: secalert@redhat.com

http://voodoo-circle.sourceforge.net/sa/sa-20090123-01.html

Source: secalert@redhat.com

http://www.ocert.org/advisories/ocert-2008-016.html

Source: secalert@redhat.com

http://www.openssl.org/news/secadv_20090107.txt

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2009-0004.html

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/499827/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/502322/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/bid/33150

Source: secalert@redhat.com

http://www.securitytracker.com/id?1021523

Source: secalert@redhat.com

http://www.us-cert.gov/cas/techalerts/TA09-133A.html

Source: secalert@redhat.com

US Government Resource

http://www.vmware.com/security/advisories/VMSA-2009-0004.html

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2009/0040

Source: secalert@redhat.com

Vendor Advisory

http://www.vupen.com/english/advisories/2009/0289

Source: secalert@redhat.com

Vendor Advisory

http://www.vupen.com/english/advisories/2009/0362

Source: secalert@redhat.com

Vendor Advisory

http://www.vupen.com/english/advisories/2009/0558

Source: secalert@redhat.com

Vendor Advisory

http://www.vupen.com/english/advisories/2009/0904

Source: secalert@redhat.com

Vendor Advisory

http://www.vupen.com/english/advisories/2009/0913

Source: secalert@redhat.com

Vendor Advisory

http://www.vupen.com/english/advisories/2009/1297

Source: secalert@redhat.com

Vendor Advisory

http://www.vupen.com/english/advisories/2009/1338

Source: secalert@redhat.com

Vendor Advisory

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6380

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9155

Source: secalert@redhat.com

https://usn.ubuntu.com/704-1/

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2009/May/msg00002.html