4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
0.264 Low
EPSS
Percentile
96.7%
Philip Mackenzie and Marius Schilder of Google informed us of Daniel Bleichenbacher’s recent presentation of a common implementation error in RSA signature verification, a failure to account for extra data in the signature. For signatures with a small exponent such as 3 it is possible for an attacker to calculate a value for this extra data to make an altered message appear to be correctly signed, allowing the signature to be forged. Mozilla’s Network Security Services (NSS) library was vulnerable to this flaw.
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4339
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4340
www.imc.org/ietf-openpgp/mail-archive/msg14307.html
www.kb.cert.org/vuls/id/845620
bugzilla.mozilla.org/show_bug.cgi?id=350640
bugzilla.mozilla.org/show_bug.cgi?id=351079
bugzilla.mozilla.org/show_bug.cgi?id=351848