NVD

Id
63414  
Name
CVE-2006-4790  
Description
verify.c in GnuTLS before 1.4.4, when using an RSA key with exponent 3, does not properly handle excess data in the digestAlgorithm.parameters field when generating a hash, which allows remote attackers to forge a PKCS #1 v1.5 signature that is signed by that RSA key and prevents GnuTLS from correctly verifying X.509 and other certificates that use PKCS, a variant of CVE-2006-4339.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:N/I:P/A:N)  
Pub Date
2016-12-20  
Published
2006-09-14  
Modified Date
2011-03-07  
Seq
2006-4790  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
330440 63414 CVE-2006-4790 [gnutls-dev] 20060908 Variant of Bleichenbacher"s crypto 06 rump session attack  View
330441 63414 CVE-2006-4790 [gnutls-dev] 20060912 Re: Variant of Bleichenbacher"s crypto 06 rump session attack  View
330442 63414 CVE-2006-4790 oval:org.mitre.oval:def:9937  View
330443 63414 CVE-2006-4790 GLSA-200609-15  View
330444 63414 CVE-2006-4790 1016844  View
330445 63414 CVE-2006-4790 102648  View
330446 63414 CVE-2006-4790 102970  View
330447 63414 CVE-2006-4790 http://support.avaya.com/elmodocs2/security/ASA-2006-250.htm  View
330448 63414 CVE-2006-4790 DSA-1182  View
330449 63414 CVE-2006-4790 http://www.gnu.org/software/gnutls/security.html  View
330450 63414 CVE-2006-4790 MDKSA-2006:166  View
330451 63414 CVE-2006-4790 SUSE-SR:2006:023  View
330452 63414 CVE-2006-4790 SUSE-SA:2007:010  View
330453 63414 CVE-2006-4790 RHSA-2006:0680  View
330454 63414 CVE-2006-4790 20027  View
330455 63414 CVE-2006-4790 USN-348-1  View
330456 63414 CVE-2006-4790 ADV-2006-3635  View
330457 63414 CVE-2006-4790 ADV-2006-3899  View
330458 63414 CVE-2006-4790 ADV-2007-2289  View
330459 63414 CVE-2006-4790 gnutls-rsakey-security-bypass(28953)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
58367 JVNDB-2006-000563 GnuTLS の verify.c における RSA 署名が偽造される脆弱性 GnuTLS の lib/x509/verify.c には、RSA 署名の検証において、ハッシュを生成する際の digestAlgorithm.parameters フィールドの取り扱いに不備が存在します。このため、公開指数が 3 である RSA 鍵による署名データが適切に処理されない脆弱性が存在します。 CVE-2006-4790 20892 CVE-2006-4790 63414 5 http://jvndb.jvn.jp/ja/contents/2006/JVNDB-2006-000563.html 2006-09-14 2007-06-28 View