SecPod SCAP Repo, a repository of SCAP Content (CVE, CCE, CPE, CWE, OVAL and XCCDF)

[Forgot Password]

Paid content will be excluded from the download.

Download | Alert*

CVE

CVE-2006-2940

Date: (C)2006-09-28 (M)2023-12-22

OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions allows attackers to cause a denial of service (CPU consumption) via parasitic public keys with large (1) "public exponent" or (2) "public modulus" values in X.509 certificates that require extra time to process when using RSA signature verification.

CVSS Score and Metrics +CVSS Score and Metrics -

CVSS V2 Severity:
CVSS Score : 7.8
Exploit Score: 10.0
Impact Score: 6.9

CVSS V2 Metrics:
Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality: NONE
Integrity: NONE
Availability: COMPLETE

Reference:

SECTRACK-1016943

SECTRACK-1017522

SUNALERT-102668

SUNALERT-102747

SUNALERT-200585

http://lists.grok.org.uk/pipermail/full-disclosure/2006-September/049715.html

http://www.securityfocus.com/archive/1/archive/1/447318/100/0/threaded

http://www.securityfocus.com/archive/1/archive/1/447393/100/0/threaded

http://www.cisco.com/en/US/products/hw/contnetw/ps4162/tsd_products_security_response09186a008077af1b.html

http://www.cisco.com/warp/public/707/cisco-sr-20061108-openssl.shtml

http://www.securityfocus.com/archive/1/archive/1/456546/100/200/threaded

http://www.securityfocus.com/archive/1/archive/1/489739/100/0/threaded

SUNALERT-201534

APPLE-SA-2006-11-28

FreeBSD-SA-06:23.openssl

NetBSD-SA2008-007

OpenPKG-SA-2006.021

SSA:2006-272-01

SUSE-SA:2006:058

SUSE-SR:2006:024

http://openbsd.org/errata.html#openssl2

http://marc.info/?l=bind-announce&m=116253119512445&w=2

http://lists.vmware.com/pipermail/security-announce/2008/000008.html

http://docs.info.apple.com/article.html?artnum=304829

http://issues.rpath.com/browse/RPL-613

http://kolab.org/security/kolab-vendor-notice-11.txt

http://openvpn.net/changelog.html

http://sourceforge.net/project/shownotes.php?release_id=461863&group_id=69227

http://support.attachmate.com/techdocs/2374.html

http://support.avaya.com/elmodocs2/security/ASA-2006-220.htm

http://support.avaya.com/elmodocs2/security/ASA-2006-260.htm

http://www.arkoon.fr/upload/alertes/37AK-2006-06-FR-1.1_FAST360_OPENSSL_ASN1.pdf

http://www.arkoon.fr/upload/alertes/41AK-2006-08-FR-1.1_SSL360_OPENSSL_ASN1.pdf

http://www.openssl.org/news/secadv_20060928.txt

http://www.oracle.com/technetwork/topics/security/cpujan2007-101493.html

http://www.serv-u.com/releasenotes/

http://www.uniras.gov.uk/niscc/docs/re-20060928-00661.pdf?lang=en

http://www.vmware.com/security/advisories/VMSA-2008-0005.html

http://www.vmware.com/support/ace2/doc/releasenotes_ace2.html

http://www.vmware.com/support/esx2/doc/esx-202-200612-patch.html

http://www.vmware.com/support/esx21/doc/esx-213-200612-patch.html

http://www.vmware.com/support/esx25/doc/esx-253-200612-patch.html

http://www.vmware.com/support/esx25/doc/esx-254-200612-patch.html

http://www.vmware.com/support/player/doc/releasenotes_player.html

http://www.vmware.com/support/player2/doc/releasenotes_player2.html

http://www.vmware.com/support/server/doc/releasenotes_server.html

http://www.vmware.com/support/vi3/doc/esx-3069097-patch.html

http://www.vmware.com/support/vi3/doc/esx-9986131-patch.html

http://www.vmware.com/support/ws55/doc/releasenotes_ws55.html

http://www.vmware.com/support/ws6/doc/releasenotes_ws6.html

http://www.xerox.com/downloads/usa/en/c/cert_ESSNetwork_XRX07001_v1.pdf

https://issues.rpath.com/browse/RPL-1633

openssl-publickey-dos(29230)

cpe:/a:openssl:openssl:0.9.7f
cpe:/a:openssl:openssl:0.9.7g
cpe:/a:openssl:openssl:0.9.7h
cpe:/a:openssl:openssl:0.9.1c
...

© SecPod Technologies