Skip to main content

Early Access — Mondoo Vulnerability Intelligence is currently in preview.

Mondoo Vulnerability Intelligence

Curated by Mondoo Research, enhanced with AI

Resources

Search Vulnerabilities
Trending CVEs
Browse Ecosystems
Terminology
Blog

Open Source

cnquery
cnspec

Star us on GitHub!

Company

Mondoo Platform
About
Contact

© 2026 Mondoo, Inc.

Privacy Policy Terms of Service Imprint

Vulnerability Intelligence

CVE-2006-4339 | Mondoo Vulnerability Intelligence

CVE-2006-4339

UNKNOWN

OpenSSL before 0

Published Sep 5, 2006

Modified 1 years ago

No fix available

Details

OpenSSL before 0.9.7, 0.9.7 before 0.9.7k, and 0.9.8 before 0.9.8c, when using an RSA key with exponent 3, removes PKCS-1 padding before generating a hash, which allows remote attackers to forge a PKCS #1 v1.5 signature that is signed by that RSA key and prevents OpenSSL from correctly verifying X.509 and other certificates that use PKCS #1.

References

ADVISORYftp://patches.sgi.com/support/free/security/advisories/20060901-01-P.asc ADVISORYhttp://dev2dev.bea.com/pub/advisory/238 WEBhttp://docs.info.apple.com/article.html?artnum=304829 WEBhttp://docs.info.apple.com/article.html?artnum=307177 ADVISORYhttp://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01070495 ADVISORYhttp://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01118771 ADVISORYhttp://itrc.hp.com/service/cki/docDisplay.do?docId=c00849540 ADVISORYhttp://jvn.jp/en/jp/JVN51615542/index.html ADVISORYhttp://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-000079.html ADVISORYhttp://lists.apple.com/archives/Security-announce/2007/Dec/msg00001.html ADVISORYhttp://lists.apple.com/archives/security-announce/2006/Nov/msg00001.html WEBhttp://lists.vmware.com/pipermail/security-announce/2008/000008.html WEBhttp://marc.info/?l=bind-announce&m=116253119512445&w=2 ADVISORYhttp://marc.info/?l=bugtraq&m=130497311408250&w=2 WEBhttp://openvpn.net/changelog.html ADVISORYhttp://secunia.com/advisories/21709 ADVISORYhttp://secunia.com/advisories/21767 ADVISORYhttp://secunia.com/advisories/21776 ADVISORYhttp://secunia.com/advisories/21778 ADVISORYhttp://secunia.com/advisories/21785 ADVISORYhttp://secunia.com/advisories/21791 ADVISORYhttp://secunia.com/advisories/21812 ADVISORYhttp://secunia.com/advisories/21823 ADVISORYhttp://secunia.com/advisories/21846 ADVISORYhttp://secunia.com/advisories/21852 ADVISORYhttp://secunia.com/advisories/21870 ADVISORYhttp://secunia.com/advisories/21873 ADVISORYhttp://secunia.com/advisories/21906 ADVISORYhttp://secunia.com/advisories/21927 ADVISORYhttp://secunia.com/advisories/21930 ADVISORYhttp://secunia.com/advisories/21982 ADVISORYhttp://secunia.com/advisories/22036 ADVISORYhttp://secunia.com/advisories/22044 ADVISORYhttp://secunia.com/advisories/22066 ADVISORYhttp://secunia.com/advisories/22161 ADVISORYhttp://secunia.com/advisories/22226 ADVISORYhttp://secunia.com/advisories/22232 ADVISORYhttp://secunia.com/advisories/22259 ADVISORYhttp://secunia.com/advisories/22260 ADVISORYhttp://secunia.com/advisories/22284 ADVISORYhttp://secunia.com/advisories/22325 ADVISORYhttp://secunia.com/advisories/22446 ADVISORYhttp://secunia.com/advisories/22509 ADVISORYhttp://secunia.com/advisories/22513 ADVISORYhttp://secunia.com/advisories/22523 ADVISORYhttp://secunia.com/advisories/22545 ADVISORYhttp://secunia.com/advisories/22585 ADVISORYhttp://secunia.com/advisories/22671 ADVISORYhttp://secunia.com/advisories/22689 ADVISORYhttp://secunia.com/advisories/22711 ADVISORYhttp://secunia.com/advisories/22733 ADVISORYhttp://secunia.com/advisories/22758 ADVISORYhttp://secunia.com/advisories/22799 ADVISORYhttp://secunia.com/advisories/22932 ADVISORYhttp://secunia.com/advisories/22934 ADVISORYhttp://secunia.com/advisories/22936 ADVISORYhttp://secunia.com/advisories/22937 ADVISORYhttp://secunia.com/advisories/22938 ADVISORYhttp://secunia.com/advisories/22939 ADVISORYhttp://secunia.com/advisories/22940 ADVISORYhttp://secunia.com/advisories/22948 ADVISORYhttp://secunia.com/advisories/22949 ADVISORYhttp://secunia.com/advisories/23155 ADVISORYhttp://secunia.com/advisories/23455 ADVISORYhttp://secunia.com/advisories/23680 ADVISORYhttp://secunia.com/advisories/23794 ADVISORYhttp://secunia.com/advisories/23841 ADVISORYhttp://secunia.com/advisories/23915 ADVISORYhttp://secunia.com/advisories/24099 ADVISORYhttp://secunia.com/advisories/24930 ADVISORYhttp://secunia.com/advisories/24950 ADVISORYhttp://secunia.com/advisories/25284 ADVISORYhttp://secunia.com/advisories/25399 ADVISORYhttp://secunia.com/advisories/25649 ADVISORYhttp://secunia.com/advisories/26329 ADVISORYhttp://secunia.com/advisories/26893 ADVISORYhttp://secunia.com/advisories/28115 ADVISORYhttp://secunia.com/advisories/31492 ADVISORYhttp://secunia.com/advisories/38567 ADVISORYhttp://secunia.com/advisories/38568 ADVISORYhttp://secunia.com/advisories/41818 ADVISORYhttp://secunia.com/advisories/60799 ADVISORYhttp://security.freebsd.org/advisories/FreeBSD-SA-06:19.openssl.asc ADVISORYhttp://security.gentoo.org/glsa/glsa-200609-05.xml ADVISORYhttp://security.gentoo.org/glsa/glsa-200609-18.xml WEBhttp://securitytracker.com/id?1016791 WEBhttp://securitytracker.com/id?1017522 ADVISORYhttp://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.566955 ADVISORYhttp://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.605306 ADVISORYhttp://sunsolve.sun.com/search/document.do?assetkey=1-26-102648-1 ADVISORYhttp://sunsolve.sun.com/search/document.do?assetkey=1-26-102656-1 ADVISORYhttp://sunsolve.sun.com/search/document.do?assetkey=1-26-102657-1 ADVISORYhttp://sunsolve.sun.com/search/document.do?assetkey=1-26-102686-1 ADVISORYhttp://sunsolve.sun.com/search/document.do?assetkey=1-26-102696-1 ADVISORYhttp://sunsolve.sun.com/search/document.do?assetkey=1-26-102722-1 ADVISORYhttp://sunsolve.sun.com/search/document.do?assetkey=1-26-102744-1 ADVISORYhttp://sunsolve.sun.com/search/document.do?assetkey=1-26-102759-1 ADVISORYhttp://sunsolve.sun.com/search/document.do?assetkey=1-66-200708-1 ADVISORYhttp://sunsolve.sun.com/search/document.do?assetkey=1-66-201247-1 ADVISORYhttp://sunsolve.sun.com/search/document.do?assetkey=1-66-201534-1 ADVISORYhttp://sunsolve.sun.com/search/document.do?assetkey=1-77-1000148.1-1 WEBhttp://support.attachmate.com/techdocs/2127.html WEBhttp://support.attachmate.com/techdocs/2128.html WEBhttp://support.attachmate.com/techdocs/2137.html WEBhttp://support.avaya.com/elmodocs2/security/ASA-2006-188.htm WEBhttp://www.arkoon.fr/upload/alertes/40AK-2006-04-FR-1.1_SSL360_OPENSSL_RSA.pdf WEBhttp://www.bluecoat.com/support/knowledge/openSSL_RSA_Signature_forgery.html ADVISORYhttp://www.cisco.com/en/US/products/hw/contnetw/ps4162/tsd_products_security_response09186a008077af1b.html ADVISORYhttp://www.cisco.com/warp/public/707/cisco-sr-20061108-openssl.shtml ADVISORYhttp://www.debian.org/security/2006/dsa-1174 ADVISORYhttp://www.gentoo.org/security/en/glsa/glsa-200610-06.xml ADVISORYhttp://www.gentoo.org/security/en/glsa/glsa-201408-19.xml WEBhttp://www.imc.org/ietf-openpgp/mail-archive/msg14307.html ADVISORYhttp://www.kb.cert.org/vuls/id/845620 ADVISORYhttp://www.mandriva.com/security/advisories?name=MDKSA-2006:161 ADVISORYhttp://www.mandriva.com/security/advisories?name=MDKSA-2006:177 ADVISORYhttp://www.mandriva.com/security/advisories?name=MDKSA-2006:178 ADVISORYhttp://www.mandriva.com/security/advisories?name=MDKSA-2006:207 WEBhttp://www.matasano.com/log/469/many-rsa-signatures-may-be-forgeable-in-openssl-and-elsewhere/ADVISORYhttp://www.novell.com/linux/security/advisories/2006_26_sr.html ADVISORYhttp://www.novell.com/linux/security/advisories/2006_55_ssl.html ADVISORYhttp://www.novell.com/linux/security/advisories/2006_61_opera.html ADVISORYhttp://www.novell.com/linux/security/advisories/2007_10_ibmjava.html ADVISORYhttp://www.openbsd.org/errata.html WEBhttp://www.openoffice.org/security/cves/CVE-2006-4339.html ADVISORYhttp://www.openpkg.com/security/advisories/OpenPKG-SA-2006.018.html ADVISORYhttp://www.openpkg.org/security/advisories/OpenPKG-SA-2006.029-bind.html WEBhttp://www.openssl.org/news/secadv_20060905.txt WEBhttp://www.opera.com/support/search/supsearch.dml?index=845 WEBhttp://www.oracle.com/technetwork/topics/security/cpujan2007-101493.html WEBhttp://www.osvdb.org/28549 ADVISORYhttp://www.redhat.com/support/errata/RHSA-2006-0661.html ADVISORYhttp://www.redhat.com/support/errata/RHSA-2007-0062.html ADVISORYhttp://www.redhat.com/support/errata/RHSA-2007-0072.html ADVISORYhttp://www.redhat.com/support/errata/RHSA-2007-0073.html ADVISORYhttp://www.redhat.com/support/errata/RHSA-2008-0629.html WEBhttp://www.securityfocus.com/archive/1/445231/100/0/threaded WEBhttp://www.securityfocus.com/archive/1/445822/100/0/threaded ADVISORYhttp://www.securityfocus.com/archive/1/450327/100/0/threaded WEBhttp://www.securityfocus.com/archive/1/456546/100/200/threaded WEBhttp://www.securityfocus.com/archive/1/489739/100/0/threaded WEBhttp://www.securityfocus.com/bid/19849 WEBhttp://www.securityfocus.com/bid/22083 WEBhttp://www.securityfocus.com/bid/28276 WEBhttp://www.serv-u.com/releasenotes/WEBhttp://www.sybase.com/detail?id=1047991 ADVISORYhttp://www.ubuntu.com/usn/usn-339-1 ADVISORYhttp://www.us-cert.gov/cas/techalerts/TA06-333A.html ADVISORYhttp://www.us.debian.org/security/2006/dsa-1173 WEBhttp://www.vmware.com/security/advisories/VMSA-2008-0005.html WEBhttp://www.vmware.com/support/ace2/doc/releasenotes_ace2.html WEBhttp://www.vmware.com/support/esx2/doc/esx-202-200612-patch.html WEBhttp://www.vmware.com/support/esx21/doc/esx-213-200612-patch.html WEBhttp://www.vmware.com/support/esx25/doc/esx-253-200612-patch.html WEBhttp://www.vmware.com/support/esx25/doc/esx-254-200612-patch.html WEBhttp://www.vmware.com/support/player/doc/releasenotes_player.html WEBhttp://www.vmware.com/support/player2/doc/releasenotes_player2.html WEBhttp://www.vmware.com/support/server/doc/releasenotes_server.html WEBhttp://www.vmware.com/support/vi3/doc/esx-3069097-patch.html WEBhttp://www.vmware.com/support/vi3/doc/esx-9986131-patch.html WEBhttp://www.vmware.com/support/ws55/doc/releasenotes_ws55.html WEBhttp://www.vmware.com/support/ws6/doc/releasenotes_ws6.html WEBhttp://www.vupen.com/english/advisories/2006/3453 WEBhttp://www.vupen.com/english/advisories/2006/3566 WEBhttp://www.vupen.com/english/advisories/2006/3730 WEBhttp://www.vupen.com/english/advisories/2006/3748 WEBhttp://www.vupen.com/english/advisories/2006/3793 WEBhttp://www.vupen.com/english/advisories/2006/3899 WEBhttp://www.vupen.com/english/advisories/2006/3936 WEBhttp://www.vupen.com/english/advisories/2006/4205 WEBhttp://www.vupen.com/english/advisories/2006/4206 WEBhttp://www.vupen.com/english/advisories/2006/4207 WEBhttp://www.vupen.com/english/advisories/2006/4216 WEBhttp://www.vupen.com/english/advisories/2006/4327 WEBhttp://www.vupen.com/english/advisories/2006/4329 WEBhttp://www.vupen.com/english/advisories/2006/4366 WEBhttp://www.vupen.com/english/advisories/2006/4417 WEBhttp://www.vupen.com/english/advisories/2006/4586 WEBhttp://www.vupen.com/english/advisories/2006/4744 WEBhttp://www.vupen.com/english/advisories/2006/4750 WEBhttp://www.vupen.com/english/advisories/2006/5146 WEBhttp://www.vupen.com/english/advisories/2007/0254 WEBhttp://www.vupen.com/english/advisories/2007/0343 WEBhttp://www.vupen.com/english/advisories/2007/1401 WEBhttp://www.vupen.com/english/advisories/2007/1815 WEBhttp://www.vupen.com/english/advisories/2007/1945 WEBhttp://www.vupen.com/english/advisories/2007/2163 WEBhttp://www.vupen.com/english/advisories/2007/2315 WEBhttp://www.vupen.com/english/advisories/2007/2783 WEBhttp://www.vupen.com/english/advisories/2007/4224 WEBhttp://www.vupen.com/english/advisories/2008/0905/references WEBhttp://www.vupen.com/english/advisories/2010/0366 ADVISORYhttp://www1.itrc.hp.com/service/cki/docDisplay.do?docId=c00771742 WEBhttp://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=3117 WEBhttps://exchange.xforce.ibmcloud.com/vulnerabilities/28755 WEBhttps://issues.rpath.com/browse/RPL-1633 WEBhttps://issues.rpath.com/browse/RPL-616 WEBhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11656 WEBhttps://secure-support.novell.com/KanisaPlatform/Publishing/41/3143224_f.SAL_Public.html ADVISORYhttps://www.cve.org/CVERecord?id=CVE-2006-4339 ADVISORYhttps://www2.itrc.hp.com/service/cki/docDisplay.do?docId=c00967144

CVSS Analysis

CVSS v2.0

4.3

Exploitability

Access Vector

NetworkAV:N

Access Complexity

MediumAC:M

Authentication

NoneAu:N

Impact

Confidentiality

PartialC:P

Integrity

NoneI:N

Availability

NoneA:N

4.3/AV:N/AC:M/Au:N/C:P/I:N/A:N

Ecosystems

Timeline

PublishedSep 5, 2006

ModifiedAug 7, 2024