CVE-2006-5179

Intoto iGateway VPN and iGateway SSL-VPN allow context-dependent attackers to cause a denial of service CPU consumption via parasitic public keys with large 1 "public exponent" or 2 "public modulus" values in X.509 certificates that require extra time to process when using RSA signature...

CVE-2006-5201

Multiple packages on Sun Solaris, including 1 NSS; 2 Java JDK and JRE 5.0 Update 8 and earlier, SDK and JRE 1.4.x up to 1.4.212, and SDK and JRE 1.3.x up to 1.3.119; 3 JSSE 1.0.303 and earlier; 4 IPSec/IKE; 5 Secure Global Desktop; and 6 StarOffice, when using an RSA key with exponent 3, removes...

CVE-2006-5201

Multiple packages on Sun Solaris, including 1 NSS; 2 Java JDK and JRE 5.0 Update 8 and earlier, SDK and JRE 1.4.x up to 1.4.212, and SDK and JRE 1.3.x up to 1.3.119; 3 JSSE 1.0.303 and earlier; 4 IPSec/IKE; 5 Secure Global Desktop; and 6 StarOffice, when using an RSA key with exponent 3, removes...

SOL6701 - Possible logon through native RSA SecurID authentication without valid passcode

An issue with the FirePass controller could permit logins without valid RSA SecurID passcodes. Under heavy load conditions, the FirePass controller can enter into a state where an invalid password in the form of the SecurID passcode is accepted if the username is a valid user in a master group...

CVE-2006-5201

CVE-2006-5201 affects Sun Solaris components (notably NSS, NSS-based libraries, Java JDK/JRE, JSSE, IPSec/IKE, and related Sun products). The root cause is when using an RSA key with exponent 3 that removes PKCS #1 padding prior to hash generation, enabling remote attackers to forge a PKCS #1 v1....

[SECURITY] [DSA 1192-1] New Mozilla packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 1192-1 [email protected] http://www.debian.org/security/ Martin Schulze October 6th, 2006 http://www.debian.org/security/faq -...

DSA-1192-1 mozilla

Bulletin has no description...

FreeBSD : gnutls -- RSA Signature Forgery Vulnerability (64bf6234-520d-11db-8f1a-000a48049292)

Secunia reports : A vulnerability has been reported in GnuTLS, which can be exploited by malicious people to bypass certain security restrictions. The vulnerability is caused due to an error in the verification of certain signatures. If a RSA key with exponent 3 is used, it may be possible to for...

GLSA-200609-18 : Opera: RSA signature forgery

The remote host is affected by the vulnerability described in GLSA-200609-18 Opera: RSA signature forgery Opera makes use of OpenSSL, which fails to correctly verify PKCS 1 v1.5 RSA signatures signed by a key with exponent 3. Some CAs in Opera's list of trusted signers are using root certificates...

openssl public key DoS

OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions allows attackers to cause a denial of service CPU consumption via parasitic public keys with large 1 "public exponent" or 2 "public modulus" values in X.509 certificates that require extra time to process when using RSA...

CVE-2006-2940

OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions allows attackers to cause a denial of service CPU consumption via parasitic public keys with large 1 "public exponent" or 2 "public modulus" values in X.509 certificates that require extra time to process when using RSA...

CVE-2006-2940

OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions allows attackers to cause a denial of service CPU consumption via parasitic public keys with large 1 "public exponent" or 2 "public modulus" values in X.509 certificates that require extra time to process when using RSA...

Code injection

OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions allows attackers to cause a denial of service CPU consumption via parasitic public keys with large 1 "public exponent" or 2 "public modulus" values in X.509 certificates that require extra time to process when using RSA...

CVE-2006-2940

OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions allows attackers to cause a denial of service CPU consumption via parasitic public keys with large 1 "public exponent" or 2 "public modulus" values in X.509 certificates that require extra time to process when using RSA...

Opera: RSA signature forgery

Background Opera is a multi-platform web browser. Description Opera makes use of OpenSSL, which fails to correctly verify PKCS 1 v1.5 RSA signatures signed by a key with exponent 3. Some CAs in Opera's list of trusted signers are using root certificates with exponent 3. Impact An attacker could...

X.509 certificate verification may be vulnerable to resource exhaustion

Overview Some applications that perform X.509 certificate verification may be vulnerable to signature processing problems that lead to resource exhaustion. This vulnerability may cause a denial of service. Description Included in X.509 certificates are public keys used for digital signature...

GLSA-200609-15 : GnuTLS: RSA Signature Forgery

The remote host is affected by the vulnerability described in GLSA-200609-15 GnuTLS: RSA Signature Forgery verify.c fails to properly handle excess data in digestAlgorithm.parameters field while generating a hash when using an RSA key with exponent 3. RSA keys that use exponent 3 are commonplace...

CVE-2006-4991

RSA Keon Certificate Authority KeonCA Manager 6.5.1 and 6.6 allows privileged local users to hide malicious Certificate Authority CA activities by modifying CA auditor logs without detection by 1 modifying or deleting a and its signature from the XML log in a way that is not detected by the...

CVE-2006-4991

RSA Keon Certificate Authority KeonCA Manager 6.5.1 and 6.6 allows privileged local users to hide malicious Certificate Authority CA activities by modifying CA auditor logs without detection by 1 modifying or deleting a and its signature from the XML log in a way that is not detected by the...

CVE-2006-4991

RSA Keon Certificate Authority (KeonCA) Manager versions 6.5.1 and 6.6 are affected. The vulnerability allows local privileged users to hide CA activities by tampering auditor logs: (1) modifying or deleting a and its signature in the XML log without triggering the integrity check on the entire ...