CVE-2008-3270

yum-rhn-plugin in Red Hat Enterprise Linux (RHEL) 5 does not verify the SSL certificate for a file download from a Red Hat Network (RHN) server, which makes it easier for remote man-in-the-middle attackers to cause a denial of service (loss of updates) or force the download and installation of official Red Hat packages that were not requested.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
2.6 UNKNOWN
NETWORK
HIGH
AV:N/AC:H/Au:N/C:N/I:P/A:N
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 53%
VendorProductVersion
redhatenterprise_linux
5.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://secunia.com/advisories/31472
http://securitytracker.com/id?1020698
http://www.redhat.com/support/errata/RHSA-2008-0815.html
http://www.securityfocus.com/bid/30695
https://bugzilla.redhat.com/show_bug.cgi?id=457113
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10864
http://secunia.com/advisories/31472
http://securitytracker.com/id?1020698
http://www.redhat.com/support/errata/RHSA-2008-0815.html
http://www.securityfocus.com/bid/30695
https://bugzilla.redhat.com/show_bug.cgi?id=457113
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10864