CVE-2006-4790
published 2006-09-14CVE-2006-4790: verify.c in GnuTLS before 1.4.4, when using an RSA key with exponent 3, does not properly handle excess data in the digestAlgorithm.parameters field when…
PriorityP425medium5CVSS 2.0
AVNACLAuNCNIPAN
EPSS
2.36%
82.0th percentile
verify.c in GnuTLS before 1.4.4, when using an RSA key with exponent 3, does not properly handle excess data in the digestAlgorithm.parameters field when generating a hash, which allows remote attackers to forge a PKCS #1 v1.5 signature that is signed by that RSA key and prevents GnuTLS from correctly verifying X.509 and other certificates that use PKCS, a variant of CVE-2006-4339.
Affected
53 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| axtls_project | axtls | <= 2.1.3 | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | strongswan | < strongswan 5.7.0-1 (bookworm) | strongswan 5.7.0-1 (bookworm) |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
osv5.0MEDIUM
vendor_debian5.0MEDIUM
vendor_redhat5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
strongswan: authentication bypass in verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c
vendor_redhat·2018-09-24·CVSS 5.0
CVE-2018-16152 [MEDIUM] CWE-287 strongswan: authentication bypass in verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c
strongswan: authentication bypass in verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c
In verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c in the gmp plugin in strongSwan 4.x and 5.x before 5.7.0, the RSA implementation based on GMP does not reject excess data in the digestAlgorithm.parameters field during PKCS#1 v1.5 signature verification. Consequently, a remote attacker can forge signatures when small public exponents are being used, which could lead to impersonation when only an RSA signature is used for IKEv2 authentication. This is a variant of CVE-2006-4790 and CVE-2014-1568.
Package: strongimcv (Red Hat Enterprise Linux 7) - Not affected
Debian
CVE-2018-16152: strongswan - In verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c in the gmp plugin in st...
vendor_debian·2018·CVSS 5.0
CVE-2018-16152 [MEDIUM] CVE-2018-16152: strongswan - In verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c in the gmp plugin in st...
In verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c in the gmp plugin in strongSwan 4.x and 5.x before 5.7.0, the RSA implementation based on GMP does not reject excess data in the digestAlgorithm.parameters field during PKCS#1 v1.5 signature verification. Consequently, a remote attacker can forge signatures when small public exponents are being used, which could lead to impersonation when only an RSA signature is used for IKEv2 authentication. This is a variant of CVE-2006-4790 and CVE-2014-1568.
Scope: local
bookworm: resolved (fixed in 5.7.0-1)
bullseye: resolved (fixed in 5.7.0-1)
forky: resolved (fixed in 5.7.0-1)
sid: resolved (fixed in 5.7.0-1)
trixie: resolved (fixed in 5.7.0-1)
Ubuntu
GnuTLS vulnerability
vendor_ubuntu·2006-09-19
CVE-2006-4790 GnuTLS vulnerability
Title: GnuTLS vulnerability
Summary: GnuTLS vulnerability
The GnuTLS library did not sufficiently check the padding of PKCS #1
v1.5 signatures if the exponent of the public key is 3 (which is
widely used for CAs). This could be exploited to forge signatures
without the need of the secret key.
Instructions: After a standard system upgrade you need to reboot your computer to
effect the necessary changes.
Red Hat
security flaw
vendor_redhat·2006-09-08·CVSS 4.3
CVE-2006-4790 [MEDIUM] security flaw
security flaw
verify.c in GnuTLS before 1.4.4, when using an RSA key with exponent 3, does not properly handle excess data in the digestAlgorithm.parameters field when generating a hash, which allows remote attackers to forge a PKCS #1 v1.5 signature that is signed by that RSA key and prevents GnuTLS from correctly verifying X.509 and other certificates that use PKCS, a variant of CVE-2006-4339.
Statement: Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.
GHSA
GHSA-g43p-7j43-jpj7: In sig_verify() in x509
ghsa_unreviewed·2022-05-14·CVSS 5.0
CVE-2018-16253 [MEDIUM] CWE-347 GHSA-g43p-7j43-jpj7: In sig_verify() in x509
In sig_verify() in x509.c in axTLS version 2.1.3 and before, the PKCS#1 v1.5 signature verification does not properly verify the ASN.1 metadata. Consequently, a remote attacker can forge signatures when small public exponents are being used, which could lead to impersonation through fake X.509 certificates. This is an even more permissive variant of CVE-2006-4790 and CVE-2014-1568.
GHSA
GHSA-ff5x-x5ch-2x28: In verify_emsa_pkcs1_signature() in gmp_rsa_public_key
ghsa_unreviewed·2022-05-13·CVSS 5.0
CVE-2018-16152 [MEDIUM] CWE-347 GHSA-ff5x-x5ch-2x28: In verify_emsa_pkcs1_signature() in gmp_rsa_public_key
In verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c in the gmp plugin in strongSwan 4.x and 5.x before 5.7.0, the RSA implementation based on GMP does not reject excess data in the digestAlgorithm.parameters field during PKCS#1 v1.5 signature verification. Consequently, a remote attacker can forge signatures when small public exponents are being used, which could lead to impersonation when only an RSA signature is used for IKEv2 authentication. This is a variant of CVE-2006-4790 and CVE-2014-1568.
GHSA
GHSA-fjc3-r8f9-57p5: verify
ghsa_unreviewed·2022-05-01·CVSS 4.3
CVE-2006-4790 [MEDIUM] GHSA-fjc3-r8f9-57p5: verify
verify.c in GnuTLS before 1.4.4, when using an RSA key with exponent 3, does not properly handle excess data in the digestAlgorithm.parameters field when generating a hash, which allows remote attackers to forge a PKCS #1 v1.5 signature that is signed by that RSA key and prevents GnuTLS from correctly verifying X.509 and other certificates that use PKCS, a variant of CVE-2006-4339.
OSV
CVE-2018-16152: In verify_emsa_pkcs1_signature() in gmp_rsa_public_key
osv·2018-09-26·CVSS 5.0
CVE-2018-16152 [MEDIUM] CVE-2018-16152: In verify_emsa_pkcs1_signature() in gmp_rsa_public_key
In verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c in the gmp plugin in strongSwan 4.x and 5.x before 5.7.0, the RSA implementation based on GMP does not reject excess data in the digestAlgorithm.parameters field during PKCS#1 v1.5 signature verification. Consequently, a remote attacker can forge signatures when small public exponents are being used, which could lead to impersonation when only an RSA signature is used for IKEv2 authentication. This is a variant of CVE-2006-4790 and CVE-2014-1568.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2018-16152 strongswan: authentication bypass in verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c
bugzilla·2018-10-03·CVSS 5.0
CVE-2018-16152 [MEDIUM] CVE-2018-16152 strongswan: authentication bypass in verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c
CVE-2018-16152 strongswan: authentication bypass in verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c
A flaw was found in strongSwan 4.x and 5.x before 5.7.0. In verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c in the gmp plugin, the RSA implementation based on GMP does not reject excess data in the digestAlgorithm.parameters field during PKCS#1 v1.5 signature verification. Consequently, a remote attacker can forge signatures when small public exponents are being used, which could lead to impersonation when only an RSA signature is used for IKEv2 authentication. This is a variant of CVE-2006-4790 and CVE-2014-1568.
References:
https://www.strongswan.org/blog/2018/09/24/strongswan-vulnerability-(cve-2018-16151,-cve-2018-16152).html
Discussion:
Created strongswan tracking bugs
Bugzilla
CVE-2006-4790 security flaw
bugzilla·2018-08-16·CVSS 4.3
CVE-2006-4790 [MEDIUM] CVE-2006-4790 security flaw
CVE-2006-4790 security flaw
Flaw bug created to hold information about an old flaw we knew something about. For more details see the MITRE CVE description.
Discussion:
MITRE description:
verify.c in GnuTLS before 1.4.4, when using an RSA key with exponent 3, does not properly handle excess data in the digestAlgorithm.parameters field when generating a hash, which allows remote attackers to forge a PKCS #1 v1.5 signature that is signed by that RSA key and prevents GnuTLS from correctly verifying X.509 and other certificates that use PKCS, a variant of CVE-2006-4339.
---
Statement:
Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.
Bugzilla
CVE-2006-4790 RSA forgery affects gnutls
bugzilla·2006-09-14·CVSS 5.0
CVE-2006-4790 [MEDIUM] CVE-2006-4790 RSA forgery affects gnutls
CVE-2006-4790 RSA forgery affects gnutls
Gnutls is implicated in RSA forgery
http://lists.gnupg.org/pipermail/gnutls-dev/2006-September/001205.html
But see
http://comments.gmane.org/gmane.linux.debian.devel.bugs.general/137142
leading to the final patch:
http://lists.gnupg.org/pipermail/gnutls-dev/2006-September/001212.html
Discussion:
Fixed in gnutls-1.0.20-3.2.3.
---
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.
http://rhn.redhat.com/errata/RHSA-2006-0680.html
http://lists.gnupg.org/pipermail/gnutls-dev/2006-September/001205.htmlhttp://lists.gnupg.org/pipermail/gnutls-dev/2006-September/001212.htmlhttp://secunia.com/advisories/21937http://secunia.com/advisories/21942http://secunia.com/advisories/21973http://secunia.com/advisories/22049http://secunia.com/advisories/22080http://secunia.com/advisories/22084http://secunia.com/advisories/22097http://secunia.com/advisories/22226http://secunia.com/advisories/22992http://secunia.com/advisories/25762http://security.gentoo.org/glsa/glsa-200609-15.xmlhttp://securitytracker.com/id?1016844http://sunsolve.sun.com/search/document.do?assetkey=1-26-102648-1http://sunsolve.sun.com/search/document.do?assetkey=1-26-102970-1http://support.avaya.com/elmodocs2/security/ASA-2006-250.htmhttp://www.debian.org/security/2006/dsa-1182http://www.gnu.org/software/gnutls/security.htmlhttp://www.mandriva.com/security/advisories?name=MDKSA-2006:166http://www.novell.com/linux/security/advisories/2006_23_sr.htmlhttp://www.novell.com/linux/security/advisories/2007_10_ibmjava.htmlhttp://www.redhat.com/support/errata/RHSA-2006-0680.htmlhttp://www.securityfocus.com/bid/20027http://www.ubuntu.com/usn/usn-348-1http://www.vupen.com/english/advisories/2006/3635http://www.vupen.com/english/advisories/2006/3899http://www.vupen.com/english/advisories/2007/2289https://exchange.xforce.ibmcloud.com/vulnerabilities/28953https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9937http://lists.gnupg.org/pipermail/gnutls-dev/2006-September/001205.htmlhttp://lists.gnupg.org/pipermail/gnutls-dev/2006-September/001212.htmlhttp://secunia.com/advisories/21937http://secunia.com/advisories/21942http://secunia.com/advisories/21973http://secunia.com/advisories/22049http://secunia.com/advisories/22080http://secunia.com/advisories/22084http://secunia.com/advisories/22097http://secunia.com/advisories/22226http://secunia.com/advisories/22992http://secunia.com/advisories/25762http://security.gentoo.org/glsa/glsa-200609-15.xmlhttp://securitytracker.com/id?1016844http://sunsolve.sun.com/search/document.do?assetkey=1-26-102648-1http://sunsolve.sun.com/search/document.do?assetkey=1-26-102970-1http://support.avaya.com/elmodocs2/security/ASA-2006-250.htmhttp://www.debian.org/security/2006/dsa-1182http://www.gnu.org/software/gnutls/security.htmlhttp://www.mandriva.com/security/advisories?name=MDKSA-2006:166http://www.novell.com/linux/security/advisories/2006_23_sr.htmlhttp://www.novell.com/linux/security/advisories/2007_10_ibmjava.htmlhttp://www.redhat.com/support/errata/RHSA-2006-0680.htmlhttp://www.securityfocus.com/bid/20027http://www.ubuntu.com/usn/usn-348-1http://www.vupen.com/english/advisories/2006/3635http://www.vupen.com/english/advisories/2006/3899http://www.vupen.com/english/advisories/2007/2289https://exchange.xforce.ibmcloud.com/vulnerabilities/28953https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9937
2006-09-14
Published