Actu
Vigil@nce: Solaris, denial of service of PKCS11
December 2008 by Vigil@nce
An attacker can create a denial of service in the PKCS#11
implementation of Solaris.
– Gravity: 2/4
– Consequences: denial of service of service
– Provenance: user shell
– Means of attack: no proof of concept, no attack
– Ability of attacker: expert (4/4)
– Confidence: confirmed by the editor (5/5)
– Diffusion of the vulnerable configuration: high (3/3)
– Creation date: 08/12/2008
IMPACTED PRODUCTS
– Sun Solaris
DESCRIPTION
The PKCS#11 standard defines the interface for cryptographic
devices. Solaris adds a layer to OpenSSL in order to provide
PKCS#11.
An attacker can corrupt the session cache in this layer. Some
functions, such as RSA_sign() or RSA_verify(), then fail.
An attacker can then create a denial of service in applications
using PKCS#11, such as Apache with the SSLCryptoDevice directive.
This vulnerability does not impact OpenSSL.
CHARACTERISTICS
– Identifiers: 246846, 6602801, BID-32671, CVE-2008-5410,
VIGILANCE-VUL-8289
– Url: http://vigilance.fr/vulnerability/8289
