SecPod SCAP Repo, a repository of SCAP Content (CVE, CCE, CPE, CWE, OVAL and XCCDF)

[Forgot Password]

Paid content will be excluded from the download.

Download | Alert*

CVE

CVE-2006-4339

Date: (C)2006-09-05 (M)2023-12-22

OpenSSL before 0.9.7, 0.9.7 before 0.9.7k, and 0.9.8 before 0.9.8c, when using an RSA key with exponent 3, removes PKCS-1 padding before generating a hash, which allows remote attackers to forge a PKCS #1 v1.5 signature that is signed by that RSA key and prevents OpenSSL from correctly verifying X.509 and other certificates that use PKCS #1.

CVSS Score and Metrics +CVSS Score and Metrics -

CVSS V2 Severity:
CVSS Score : 4.3
Exploit Score: 8.6
Impact Score: 2.9

CVSS V2 Metrics:
Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality: PARTIAL
Integrity: NONE
Availability: NONE

Reference:

SUNALERT-1000148

SECTRACK-1016791

SECTRACK-1017522

SUNALERT-102648

SUNALERT-102656

SUNALERT-102657

SUNALERT-102686

SUNALERT-102696

SUNALERT-102722

SUNALERT-102744

SUNALERT-102759

http://www.securityfocus.com/archive/1/archive/1/445231/100/0/threaded

http://www.securityfocus.com/archive/1/archive/1/445822/100/0/threaded

http://www.cisco.com/en/US/products/hw/contnetw/ps4162/tsd_products_security_response09186a008077af1b.html

http://www.cisco.com/warp/public/707/cisco-sr-20061108-openssl.shtml

http://www.securityfocus.com/archive/1/archive/1/456546/100/200/threaded

SUNALERT-200708

http://www.securityfocus.com/archive/1/archive/1/489739/100/0/threaded

SUNALERT-201247

SUNALERT-201534

APPLE-SA-2006-11-28

APPLE-SA-2007-12-14

FreeBSD-SA-06:19

JVNDB-2012-000079

OpenPKG-SA-2006.018

OpenPKG-SA-2006.029

SSA:2006-257-02

SSA:2006-310-01

SUSE-SA:2006:055

SUSE-SA:2006:061

SUSE-SA:2007:010

SUSE-SR:2006:026

http://www.openbsd.org/errata.html

http://marc.info/?l=bind-announce&m=116253119512445&w=2

http://www.imc.org/ietf-openpgp/mail-archive/msg14307.html

http://lists.vmware.com/pipermail/security-announce/2008/000008.html

http://docs.info.apple.com/article.html?artnum=304829

http://docs.info.apple.com/article.html?artnum=307177

http://openvpn.net/changelog.html

http://support.attachmate.com/techdocs/2127.html

http://support.attachmate.com/techdocs/2128.html

http://support.attachmate.com/techdocs/2137.html

http://support.avaya.com/elmodocs2/security/ASA-2006-188.htm

http://www.arkoon.fr/upload/alertes/40AK-2006-04-FR-1.1_SSL360_OPENSSL_RSA.pdf

http://www.bluecoat.com/support/knowledge/openSSL_RSA_Signature_forgery.html

http://www.matasano.com/log/469/many-rsa-signatures-may-be-forgeable-in-openssl-and-elsewhere/

http://www.openoffice.org/security/cves/CVE-2006-4339.html

http://www.openssl.org/news/secadv_20060905.txt

http://www.opera.com/support/search/supsearch.dml?index=845

http://www.oracle.com/technetwork/topics/security/cpujan2007-101493.html

http://www.serv-u.com/releasenotes/

http://www.sybase.com/detail?id=1047991

http://www.vmware.com/security/advisories/VMSA-2008-0005.html

http://www.vmware.com/support/ace2/doc/releasenotes_ace2.html

http://www.vmware.com/support/esx2/doc/esx-202-200612-patch.html

http://www.vmware.com/support/esx21/doc/esx-213-200612-patch.html

http://www.vmware.com/support/esx25/doc/esx-253-200612-patch.html

http://www.vmware.com/support/esx25/doc/esx-254-200612-patch.html

http://www.vmware.com/support/player/doc/releasenotes_player.html

http://www.vmware.com/support/player2/doc/releasenotes_player2.html

http://www.vmware.com/support/server/doc/releasenotes_server.html

http://www.vmware.com/support/vi3/doc/esx-3069097-patch.html

http://www.vmware.com/support/vi3/doc/esx-9986131-patch.html

http://www.vmware.com/support/ws55/doc/releasenotes_ws55.html

http://www.vmware.com/support/ws6/doc/releasenotes_ws6.html

http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=3117

https://issues.rpath.com/browse/RPL-1633

https://issues.rpath.com/browse/RPL-616

https://secure-support.novell.com/KanisaPlatform/Publishing/41/3143224_f.SAL_Public.html

openssl-rsa-security-bypass(28755)

cpe:/a:openssl:openssl:0.9.7f
cpe:/a:openssl:openssl:0.9.7g
cpe:/a:openssl:openssl:0.9.7h
cpe:/a:openssl:openssl:0.9.1c
...

© SecPod Technologies