CVE-2012-3367

Vulnerability

Red Hat Certificate System (RHCS) before 8.1.1 and Dogtag Certificate System do not properly check certificate revocation requests made through the web interface [1][3]. The bug resides in the Certificate Manager's handling of revocation requests; it fails to verify that the request targets an end-entity certificate rather than the Certificate Authority (CA) certificate. This affects all versions prior to the RHSA-2012-1103 update [1].

Exploitation

An attacker must be an agent with permissions to revoke end entity certificates via the web interface [1][3]. No additional authentication bypass or network position beyond the normal administrative web access is required. The attacker submits a revocation request for the CA certificate, which the system incorrectly accepts due to the missing check [3].

Impact

A successful attack revokes the CA certificate, which can break trust for the entire PKI deployment and potentially cause a denial of service or enable further attacks [1][3]. The privilege level required is that of a revocation agent, which is a specific role in Certificate System.

Mitigation

The fix is included in the updated pki-common, pki-tps, and pki-util packages released in RHSA-2012-1103 (July 19, 2012) for Red Hat Certificate System 8.1.1 [1]. The patch is available at [2]. All Certificate System subsystems must be restarted after applying the update [1]. No workaround is documented for unpatched systems.