critical9.1
CVE-2006-4339
A flaw was found in OpenSSL.
Impact
A flaw was found in OpenSSL. When configured to use an RSA key with exponent 3, OpenSSL improperly removes PKCS-1 padding before generating a hash. This allows remote attackers to forge PKCS #1 v1.5 signatures. Consequently, OpenSSL may incorrectly verify X.509 and other certificates, leading to a bypass of trust and authentication mechanisms.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Openssl | Openssl | through 0.9.7 Versions 0.9.1c, 0.9.2b, 0.9.3, 0.9.3a, 0.9.4 |
Weakness classification
References
- NVD record
- CVE.org record
- http://dev2dev.bea.com/pub/advisory/238
- http://docs.info.apple.com/article.html?artnum=304829
- http://docs.info.apple.com/article.html?artnum=307177
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01070495
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01118771
- http://itrc.hp.com/service/cki/docDisplay.do?docId=c00849540
- http://jvn.jp/en/jp/JVN51615542/index.html
- http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-000079.html
- http://lists.apple.com/archives/Security-announce/2007/Dec/msg00001.html
- http://lists.apple.com/archives/security-announce/2006/Nov/msg00001.html
- http://lists.vmware.com/pipermail/security-announce/2008/000008.html
- http://marc.info/?l=bind-announce&m=116253119512445&w=2
- http://marc.info/?l=bugtraq&m=130497311408250&w=2
- http://openvpn.net/changelog.html
- http://secunia.com/advisories/21709
- http://secunia.com/advisories/21767
- http://secunia.com/advisories/21776
- http://secunia.com/advisories/21778
- http://secunia.com/advisories/21785
- http://secunia.com/advisories/21791
- http://secunia.com/advisories/21812
- http://secunia.com/advisories/21823
- http://secunia.com/advisories/21846
- http://secunia.com/advisories/21852
- http://secunia.com/advisories/21870