by Kastro
Paper/Archive/CVE-2006-4339

CVE-2006-4339

Red Hat Red Hat Enterprise Linux 3 — Openssl: openssl: signature forgery via improper pkcs-1 padding removal leading to certificate validation bypass

EPSS 5%CVSS 9.1
critical.is priorityof 100
46
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 92.3.923 × 2018.5No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A flaw was found in OpenSSL. When configured to use an RSA key with exponent 3, OpenSSL improperly removes PKCS-1 padding before generating a hash. This allows remote attackers to forge PKCS #1 v1.5 signatures. Consequently, OpenSSL may incorrectly verify X.509 and other certificates, leading to a bypass of trust and authentication mechanisms.

Affected

ProductAffectedFixed inSource
Red Hat Enterprise Linux 3see advisory0:0.9.7a-33.18CNA
Red Hat Enterprise Linux 3see advisory0:0.9.6b-16.43CNA
Red Hat Enterprise Linux 4see advisory0:0.9.7a-43.11CNA
Red Hat Enterprise Linux 4see advisory0:0.9.6b-22.43CNA
Red Hat Network Satellite Server v 4.2see advisory0:5.0.2-3CNA
Red Hat Network Satellite Server v 4.2see advisory0:1-0CNA
Red Hat Network Satellite Server v 4.2 (RHEL3)see advisory0:5.0.2-3CNA
Red Hat Network Satellite Server v 4.2 (RHEL3)see advisory0:1-0CNA
Red Hat Network Satellite Server v 5.0see advisory0:5.0.2-3CNA
Red Hat Network Satellite Server v 5.0see advisory0:1-0CNA
Red Hat Network Satellite Server v 5.1see advisory0:5.1.1-3CNA
Red Hat Network Satellite Server v 5.1see advisory0:1-0CNA

Scores by source

redhat (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

advisorydev2dev.bea.com/pub/advisory/238refdocs.info.apple.com/article.html?artnum=304829refdocs.info.apple.com/article.html?artnum=307177advisoryh20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01070495advisoryh20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01118771advisoryitrc.hp.com/service/cki/docDisplay.do?docId=c00849540writeupjvn.jp/en/jp/JVN51615542/index.htmlwriteupjvndb.jvn.jp/ja/contents/2012/JVNDB-2012-000079.htmladvisorylists.apple.com/archives/Security-announce/2007/Dec/msg00001.htmladvisorylists.apple.com/archives/security-announce/2006/Nov/msg00001.htmlreflists.vmware.com/pipermail/security-announce/2008/000008.htmlrefmarc.info/?l=bind-announce&m=116253119512445&w=2advisorymarc.info/?l=bugtraq&m=130497311408250&w=2refopenvpn.net/changelog.htmlwriteupsecunia.com/advisories/21709writeupsecunia.com/advisories/21767writeupsecunia.com/advisories/21776writeupsecunia.com/advisories/21778writeupsecunia.com/advisories/21785writeupsecunia.com/advisories/21791writeupsecunia.com/advisories/21812writeupsecunia.com/advisories/21823writeupsecunia.com/advisories/21846writeupsecunia.com/advisories/21852writeupsecunia.com/advisories/21870writeupsecunia.com/advisories/21873writeupsecunia.com/advisories/21906writeupsecunia.com/advisories/21927writeupsecunia.com/advisories/21930writeupsecunia.com/advisories/21982writeupsecunia.com/advisories/22036writeupsecunia.com/advisories/22044writeupsecunia.com/advisories/22066writeupsecunia.com/advisories/22161writeupsecunia.com/advisories/22226writeupsecunia.com/advisories/22232writeupsecunia.com/advisories/22259writeupsecunia.com/advisories/22260writeupsecunia.com/advisories/22284writeupsecunia.com/advisories/22325writeupsecunia.com/advisories/22446writeupsecunia.com/advisories/22509writeupsecunia.com/advisories/22513writeupsecunia.com/advisories/22523writeupsecunia.com/advisories/22545writeupsecunia.com/advisories/22585writeupsecunia.com/advisories/22671writeupsecunia.com/advisories/22689writeupsecunia.com/advisories/22711writeupsecunia.com/advisories/22733writeupsecunia.com/advisories/22758writeupsecunia.com/advisories/22799writeupsecunia.com/advisories/22932writeupsecunia.com/advisories/22934writeupsecunia.com/advisories/22936writeupsecunia.com/advisories/22937writeupsecunia.com/advisories/22938writeupsecunia.com/advisories/22939writeupsecunia.com/advisories/22940writeupsecunia.com/advisories/22948writeupsecunia.com/advisories/22949writeupsecunia.com/advisories/23155writeupsecunia.com/advisories/23455writeupsecunia.com/advisories/23680writeupsecunia.com/advisories/23794writeupsecunia.com/advisories/23841writeupsecunia.com/advisories/23915writeupsecunia.com/advisories/24099writeupsecunia.com/advisories/24930writeupsecunia.com/advisories/24950writeupsecunia.com/advisories/25284writeupsecunia.com/advisories/25399writeupsecunia.com/advisories/25649writeupsecunia.com/advisories/26329writeupsecunia.com/advisories/26893writeupsecunia.com/advisories/28115writeupsecunia.com/advisories/31492writeupsecunia.com/advisories/38567writeupsecunia.com/advisories/38568writeupsecunia.com/advisories/41818writeupsecunia.com/advisories/60799advisorysecurity.freebsd.org/advisories/FreeBSD-SA-06:19.openssl.ascadvisorysecurity.gentoo.org/glsa/glsa-200609-05.xmladvisorysecurity.gentoo.org/glsa/glsa-200609-18.xmlrefsecuritytracker.com/id?1016791refsecuritytracker.com/id?1017522advisoryslackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.566955advisoryslackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.605306advisorysunsolve.sun.com/search/document.do?assetkey=1-26-102648-1advisorysunsolve.sun.com/search/document.do?assetkey=1-26-102656-1advisorysunsolve.sun.com/search/document.do?assetkey=1-26-102657-1advisorysunsolve.sun.com/search/document.do?assetkey=1-26-102686-1advisorysunsolve.sun.com/search/document.do?assetkey=1-26-102696-1advisorysunsolve.sun.com/search/document.do?assetkey=1-26-102722-1advisorysunsolve.sun.com/search/document.do?assetkey=1-26-102744-1advisorysunsolve.sun.com/search/document.do?assetkey=1-26-102759-1advisorysunsolve.sun.com/search/document.do?assetkey=1-66-200708-1advisorysunsolve.sun.com/search/document.do?assetkey=1-66-201247-1advisorysunsolve.sun.com/search/document.do?assetkey=1-66-201534-1advisorysunsolve.sun.com/search/document.do?assetkey=1-77-1000148.1-1refsupport.attachmate.com/techdocs/2127.htmlrefsupport.attachmate.com/techdocs/2128.htmlrefsupport.attachmate.com/techdocs/2137.htmlrefsupport.avaya.com/elmodocs2/security/ASA-2006-188.htmrefarkoon.fr/upload/alertes/40AK-2006-04-FR-1.1_SSL360_OPENSSL_RSA.pdfrefbluecoat.com/support/knowledge/openSSL_RSA_Signature_forgery.htmladvisorycisco.com/en/US/products/hw/contnetw/ps4162/tsd_products_security_response09186a008077af1b.htmladvisorycisco.com/warp/public/707/cisco-sr-20061108-openssl.shtmladvisorydebian.org/security/2006/dsa-1174advisorygentoo.org/security/en/glsa/glsa-200610-06.xmladvisorygentoo.org/security/en/glsa/glsa-201408-19.xmlrefimc.org/ietf-openpgp/mail-archive/msg14307.htmlwriteupkb.cert.org/vuls/id/845620advisorymandriva.com/security/advisories?name=MDKSA-2006:161advisorymandriva.com/security/advisories?name=MDKSA-2006:177advisorymandriva.com/security/advisories?name=MDKSA-2006:178advisorymandriva.com/security/advisories?name=MDKSA-2006:207refmatasano.com/log/469/many-rsa-signatures-may-be-forgeable-in-openssl-and-elsewhereadvisorynovell.com/linux/security/advisories/2006_26_sr.htmladvisorynovell.com/linux/security/advisories/2006_55_ssl.htmladvisorynovell.com/linux/security/advisories/2006_61_opera.htmladvisorynovell.com/linux/security/advisories/2007_10_ibmjava.htmladvisoryopenbsd.org/errata.htmlrefopenoffice.org/security/cves/CVE-2006-4339.htmladvisoryopenpkg.com/security/advisories/OpenPKG-SA-2006.018.htmladvisoryopenpkg.org/security/advisories/OpenPKG-SA-2006.029-bind.htmlrefopenssl.org/news/secadv_20060905.txtrefopera.com/support/search/supsearch.dml?index=845reforacle.com/technetwork/topics/security/cpujan2007-101493.htmlrefosvdb.org/28549advisoryredhat.com/support/errata/RHSA-2006-0661.htmladvisoryredhat.com/support/errata/RHSA-2007-0062.htmladvisoryredhat.com/support/errata/RHSA-2007-0072.htmladvisoryredhat.com/support/errata/RHSA-2007-0073.htmladvisoryredhat.com/support/errata/RHSA-2008-0629.htmlrefsecurityfocus.com/archive/1/445231/100/0/threadedrefsecurityfocus.com/archive/1/445822/100/0/threadedadvisorysecurityfocus.com/archive/1/450327/100/0/threadedrefsecurityfocus.com/archive/1/456546/100/200/threadedrefsecurityfocus.com/archive/1/489739/100/0/threadedrefsecurityfocus.com/bid/19849refsecurityfocus.com/bid/22083refsecurityfocus.com/bid/28276refserv-u.com/releasenotesrefsybase.com/detail?id=1047991advisoryubuntu.com/usn/usn-339-1writeupus-cert.gov/cas/techalerts/TA06-333A.htmladvisoryus.debian.org/security/2006/dsa-1173refvmware.com/security/advisories/VMSA-2008-0005.htmlrefvmware.com/support/ace2/doc/releasenotes_ace2.htmlrefvmware.com/support/esx2/doc/esx-202-200612-patch.htmlrefvmware.com/support/esx21/doc/esx-213-200612-patch.htmlrefvmware.com/support/esx25/doc/esx-253-200612-patch.htmlrefvmware.com/support/esx25/doc/esx-254-200612-patch.htmlrefvmware.com/support/player/doc/releasenotes_player.htmlrefvmware.com/support/player2/doc/releasenotes_player2.htmlrefvmware.com/support/server/doc/releasenotes_server.htmlrefvmware.com/support/vi3/doc/esx-3069097-patch.htmlrefvmware.com/support/vi3/doc/esx-9986131-patch.htmlrefvmware.com/support/ws55/doc/releasenotes_ws55.htmlrefvmware.com/support/ws6/doc/releasenotes_ws6.htmlrefvupen.com/english/advisories/2006/3453refvupen.com/english/advisories/2006/3566refvupen.com/english/advisories/2006/3730refvupen.com/english/advisories/2006/3748refvupen.com/english/advisories/2006/3793refvupen.com/english/advisories/2006/3899refvupen.com/english/advisories/2006/3936refvupen.com/english/advisories/2006/4205refvupen.com/english/advisories/2006/4206refvupen.com/english/advisories/2006/4207refvupen.com/english/advisories/2006/4216refvupen.com/english/advisories/2006/4327refvupen.com/english/advisories/2006/4329refvupen.com/english/advisories/2006/4366refvupen.com/english/advisories/2006/4417refvupen.com/english/advisories/2006/4586refvupen.com/english/advisories/2006/4744refvupen.com/english/advisories/2006/4750refvupen.com/english/advisories/2006/5146refvupen.com/english/advisories/2007/0254refvupen.com/english/advisories/2007/0343refvupen.com/english/advisories/2007/1401refvupen.com/english/advisories/2007/1815refvupen.com/english/advisories/2007/1945refvupen.com/english/advisories/2007/2163refvupen.com/english/advisories/2007/2315refvupen.com/english/advisories/2007/2783refvupen.com/english/advisories/2007/4224refvupen.com/english/advisories/2008/0905/referencesrefvupen.com/english/advisories/2010/0366advisorywww1.itrc.hp.com/service/cki/docDisplay.do?docId=c00771742refwww14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=3117advisoryaccess.redhat.com/errata/RHSA-2006:0661advisoryaccess.redhat.com/errata/RHSA-2007:0062advisoryaccess.redhat.com/errata/RHSA-2007:0072advisoryaccess.redhat.com/errata/RHSA-2007:0073advisoryaccess.redhat.com/errata/RHSA-2008:0264advisoryaccess.redhat.com/errata/RHSA-2008:0525advisoryaccess.redhat.com/errata/RHSA-2008:0629refaccess.redhat.com/security/cve/CVE-2006-4339refexchange.xforce.ibmcloud.com/vulnerabilities/28755refissues.rpath.com/browse/RPL-1633refissues.rpath.com/browse/RPL-616refoval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11656refsecure-support.novell.com/KanisaPlatform/Publishing/41/3143224_f.SAL_Public.htmladvisorywww2.itrc.hp.com/service/cki/docDisplay.do?docId=c00967144
advisoryftp://patches.sgi.com/support/free/security/advisories/20060901-01-P.asc