CVE-2009-0046

Published: Jan 7, 2009Modified: Apr 23, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

Sun GridEngine 5.3 and earlier does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys, a similar vulnerability to CVE-2008-5077.

Affected (3)

Products: Sun: Grid Engine

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Sun Grid Engine	Up to 5.3
Sun Grid Engine	Version 5.3 beta1
Sun Grid Engine	Version 5.3 beta2

Related CWEs

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (6)

http://www.ocert.org/advisories/ocert-2008-016.html

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/499827/100/0/threaded

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2009/0045

Source: cve@mitre.org

Vendor Advisory

http://www.ocert.org/advisories/ocert-2008-016.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/499827/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2009/0045

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.