CVE-2006-2940

Published: Sep 28, 2006Modified: Apr 23, 2026

7.8

Vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Exploitability: 10.0 / Impact: 6.9

Source: NVD

Description

OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions allows attackers to cause a denial of service (CPU consumption) via parasitic public keys with large (1) "public exponent" or (2) "public modulus" values in X.509 certificates that require extra time to process when using RSA signature verification.

Affected (47)

Products: Openssl: Openssl

Openssl

1 product

Openssl

Configuration A

47 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	Version 0.9.1c
Openssl Openssl	Version 0.9.2b
Openssl Openssl	Version 0.9.3
Openssl Openssl	Version 0.9.3a
Openssl Openssl	Version 0.9.4
Openssl Openssl	Version 0.9.5
Openssl Openssl	Version 0.9.5 beta1
Openssl Openssl	Version 0.9.5 beta2
Openssl Openssl	Version 0.9.5a
Openssl Openssl	Version 0.9.5a beta1
Openssl Openssl	Version 0.9.5a beta2
Openssl Openssl	Version 0.9.6
Openssl Openssl	Version 0.9.6 beta1
Openssl Openssl	Version 0.9.6 beta2
Openssl Openssl	Version 0.9.6 beta3
Openssl Openssl	Version 0.9.6a
Openssl Openssl	Version 0.9.6a beta1
Openssl Openssl	Version 0.9.6a beta2
Openssl Openssl	Version 0.9.6a beta3
Openssl Openssl	Version 0.9.6b
Openssl Openssl	Version 0.9.6c
Openssl Openssl	Version 0.9.6d
Openssl Openssl	Version 0.9.6e
Openssl Openssl	Version 0.9.6f
Openssl Openssl	Version 0.9.6g
Openssl Openssl	Version 0.9.6h
Openssl Openssl	Version 0.9.6i
Openssl Openssl	Version 0.9.6j
Openssl Openssl	Version 0.9.6k
Openssl Openssl	Version 0.9.6l
Openssl Openssl	Version 0.9.6m
Openssl Openssl	Version 0.9.7
Openssl Openssl	Version 0.9.7a
Openssl Openssl	Version 0.9.7b
Openssl Openssl	Version 0.9.7c
Openssl Openssl	Version 0.9.7d
Openssl Openssl	Version 0.9.7e
Openssl Openssl	Version 0.9.7f
Openssl Openssl	Version 0.9.7g
Openssl Openssl	Version 0.9.7h
Openssl Openssl	Version 0.9.7i
Openssl Openssl	Version 0.9.7j
Openssl Openssl	Version 0.9.7k
Openssl Openssl	Version 0.9.8
Openssl Openssl	Version 0.9.8a
Openssl Openssl	Version 0.9.8b
Openssl Openssl	Version 0.9.8c

Related CWEs

CWE-399

References (284)

ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-007.txt.asc (unsafe URL)

Source: secalert@redhat.com

ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc (unsafe URL)

Source: secalert@redhat.com

http://docs.info.apple.com/article.html?artnum=304829

Source: secalert@redhat.com

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01118771

Source: secalert@redhat.com

http://issues.rpath.com/browse/RPL-613

Source: secalert@redhat.com

http://itrc.hp.com/service/cki/docDisplay.do?docId=c00805100

Source: secalert@redhat.com

http://itrc.hp.com/service/cki/docDisplay.do?docId=c00849540

Source: secalert@redhat.com

http://kolab.org/security/kolab-vendor-notice-11.txt

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2006/Nov/msg00001.html

Source: secalert@redhat.com

http://lists.grok.org.uk/pipermail/full-disclosure/2006-September/049715.html

Source: secalert@redhat.com

http://lists.vmware.com/pipermail/security-announce/2008/000008.html

Source: secalert@redhat.com

http://marc.info/?l=bind-announce&m=116253119512445&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=130497311408250&w=2

Source: secalert@redhat.com

http://openbsd.org/errata.html#openssl2

Source: secalert@redhat.com

http://openvpn.net/changelog.html

Source: secalert@redhat.com

http://secunia.com/advisories/22094

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/22116

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/22130

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/22165

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/22166

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/22172

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/22186

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/22193

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/22207

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/22212

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/22216

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/22220

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/22240

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/22259

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/22260

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/22284

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/22298

Source: secalert@redhat.com

http://secunia.com/advisories/22330

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/22385

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/22460

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/22487

Source: secalert@redhat.com

http://secunia.com/advisories/22500

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/22544

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/22626

Source: secalert@redhat.com

http://secunia.com/advisories/22671

Source: secalert@redhat.com

http://secunia.com/advisories/22758

Source: secalert@redhat.com

http://secunia.com/advisories/22772

Source: secalert@redhat.com

http://secunia.com/advisories/22799

Source: secalert@redhat.com

http://secunia.com/advisories/23038

Source: secalert@redhat.com

http://secunia.com/advisories/23155

Source: secalert@redhat.com

http://secunia.com/advisories/23280

Source: secalert@redhat.com

http://secunia.com/advisories/23309

Source: secalert@redhat.com

http://secunia.com/advisories/23340

Source: secalert@redhat.com

http://secunia.com/advisories/23351

Source: secalert@redhat.com

http://secunia.com/advisories/23680

Source: secalert@redhat.com

http://secunia.com/advisories/23794

Source: secalert@redhat.com

http://secunia.com/advisories/23915

Source: secalert@redhat.com

http://secunia.com/advisories/24930

Source: secalert@redhat.com

http://secunia.com/advisories/24950

Source: secalert@redhat.com

http://secunia.com/advisories/25889

Source: secalert@redhat.com

http://secunia.com/advisories/26329

Source: secalert@redhat.com

http://secunia.com/advisories/26893

Source: secalert@redhat.com

http://secunia.com/advisories/30124

Source: secalert@redhat.com

http://secunia.com/advisories/31492

Source: secalert@redhat.com

http://secunia.com/advisories/31531

Source: secalert@redhat.com

http://security.freebsd.org/advisories/FreeBSD-SA-06:23.openssl.asc

Source: secalert@redhat.com

http://security.gentoo.org/glsa/glsa-200610-11.xml

Source: secalert@redhat.com

http://securitytracker.com/id?1016943

Source: secalert@redhat.com

http://securitytracker.com/id?1017522

Source: secalert@redhat.com

http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.676946

Source: secalert@redhat.com

http://sourceforge.net/project/shownotes.php?release_id=461863&group_id=69227

Source: secalert@redhat.com

http://sunsolve.sun.com/search/document.do?assetkey=1-26-102668-1

Source: secalert@redhat.com

http://sunsolve.sun.com/search/document.do?assetkey=1-26-102747-1

Source: secalert@redhat.com

http://sunsolve.sun.com/search/document.do?assetkey=1-66-200585-1

Source: secalert@redhat.com

http://sunsolve.sun.com/search/document.do?assetkey=1-66-201534-1

Source: secalert@redhat.com

http://support.attachmate.com/techdocs/2374.html

Source: secalert@redhat.com

http://support.avaya.com/elmodocs2/security/ASA-2006-220.htm

Source: secalert@redhat.com

http://support.avaya.com/elmodocs2/security/ASA-2006-260.htm

Source: secalert@redhat.com

http://www.arkoon.fr/upload/alertes/37AK-2006-06-FR-1.1_FAST360_OPENSSL_ASN1.pdf

Source: secalert@redhat.com

http://www.arkoon.fr/upload/alertes/41AK-2006-08-FR-1.1_SSL360_OPENSSL_ASN1.pdf

Source: secalert@redhat.com

http://www.cisco.com/en/US/products/hw/contnetw/ps4162/tsd_products_security_response09186a008077af1b.html

Source: secalert@redhat.com

http://www.cisco.com/warp/public/707/cisco-sr-20061108-openssl.shtml

Source: secalert@redhat.com

http://www.debian.org/security/2006/dsa-1185

Source: secalert@redhat.com

http://www.debian.org/security/2006/dsa-1195

Source: secalert@redhat.com

http://www.gentoo.org/security/en/glsa/glsa-200612-11.xml

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDKSA-2006:172

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDKSA-2006:177

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDKSA-2006:178

Source: secalert@redhat.com

http://www.novell.com/linux/security/advisories/2006_24_sr.html

Source: secalert@redhat.com

http://www.novell.com/linux/security/advisories/2006_58_openssl.html

Source: secalert@redhat.com

http://www.openpkg.org/security/advisories/OpenPKG-SA-2006.021-openssl.html

Source: secalert@redhat.com

http://www.openssl.org/news/secadv_20060928.txt

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/cpujan2007-101493.html

Source: secalert@redhat.com

http://www.osvdb.org/29261

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2006-0695.html

Source: secalert@redhat.com

Vendor Advisory

http://www.redhat.com/support/errata/RHSA-2008-0629.html

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/447318/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/447393/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/456546/100/200/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/489739/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/bid/20247

Source: secalert@redhat.com

http://www.securityfocus.com/bid/22083

Source: secalert@redhat.com

http://www.securityfocus.com/bid/28276

Source: secalert@redhat.com

http://www.serv-u.com/releasenotes/

Source: secalert@redhat.com

http://www.trustix.org/errata/2006/0054

Source: secalert@redhat.com

http://www.ubuntu.com/usn/usn-353-1

Source: secalert@redhat.com

http://www.ubuntu.com/usn/usn-353-2

Source: secalert@redhat.com

http://www.uniras.gov.uk/niscc/docs/re-20060928-00661.pdf?lang=en

Source: secalert@redhat.com

http://www.us-cert.gov/cas/techalerts/TA06-333A.html

Source: secalert@redhat.com

US Government Resource

http://www.vmware.com/security/advisories/VMSA-2008-0005.html

Source: secalert@redhat.com

http://www.vmware.com/support/ace2/doc/releasenotes_ace2.html

Source: secalert@redhat.com

http://www.vmware.com/support/esx2/doc/esx-202-200612-patch.html

Source: secalert@redhat.com

http://www.vmware.com/support/esx21/doc/esx-213-200612-patch.html

Source: secalert@redhat.com

http://www.vmware.com/support/esx25/doc/esx-253-200612-patch.html

Source: secalert@redhat.com

http://www.vmware.com/support/esx25/doc/esx-254-200612-patch.html

Source: secalert@redhat.com

http://www.vmware.com/support/player/doc/releasenotes_player.html

Source: secalert@redhat.com

http://www.vmware.com/support/player2/doc/releasenotes_player2.html

Source: secalert@redhat.com

http://www.vmware.com/support/server/doc/releasenotes_server.html

Source: secalert@redhat.com

http://www.vmware.com/support/vi3/doc/esx-3069097-patch.html

Source: secalert@redhat.com

http://www.vmware.com/support/vi3/doc/esx-9986131-patch.html

Source: secalert@redhat.com

http://www.vmware.com/support/ws55/doc/releasenotes_ws55.html

Source: secalert@redhat.com

http://www.vmware.com/support/ws6/doc/releasenotes_ws6.html

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2006/3820

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2006/3860

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2006/3869

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2006/3902

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2006/3936

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2006/4019

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2006/4036

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2006/4264

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2006/4327

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2006/4329

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2006/4401

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2006/4417

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2006/4750

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2006/4980

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2007/0343

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2007/1401

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2007/2315

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2007/2783

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2008/0905/references

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2008/2396

Source: secalert@redhat.com

http://www.xerox.com/downloads/usa/en/c/cert_ESSNetwork_XRX07001_v1.pdf

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/29230

Source: secalert@redhat.com

https://issues.rpath.com/browse/RPL-1633

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10311

Source: secalert@redhat.com

https://www2.itrc.hp.com/service/cki/docDisplay.do?docId=c00967144

Source: secalert@redhat.com

ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-007.txt.asc (unsafe URL)