OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions allows attackers to cause a denial of service (CPU consumption) via parasitic public keys with large (1) "public exponent" or (2) "public modulus" values in X.509 certificates that require extra time to process when using RSA signature verification.
References
Link Providers
ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-007.txt.asc cve-icon cve-icon
ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc cve-icon cve-icon
http://docs.info.apple.com/article.html?artnum=304829 cve-icon cve-icon
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01118771 cve-icon cve-icon
http://issues.rpath.com/browse/RPL-613 cve-icon cve-icon
http://itrc.hp.com/service/cki/docDisplay.do?docId=c00805100 cve-icon cve-icon
http://itrc.hp.com/service/cki/docDisplay.do?docId=c00849540 cve-icon cve-icon
http://kolab.org/security/kolab-vendor-notice-11.txt cve-icon cve-icon
http://lists.apple.com/archives/security-announce/2006/Nov/msg00001.html cve-icon cve-icon
http://lists.grok.org.uk/pipermail/full-disclosure/2006-September/049715.html cve-icon cve-icon
http://lists.vmware.com/pipermail/security-announce/2008/000008.html cve-icon cve-icon
http://marc.info/?l=bind-announce&m=116253119512445&w=2 cve-icon cve-icon
http://marc.info/?l=bugtraq&m=130497311408250&w=2 cve-icon cve-icon
http://openbsd.org/errata.html#openssl2 cve-icon cve-icon
http://openvpn.net/changelog.html cve-icon cve-icon
http://secunia.com/advisories/22094 cve-icon cve-icon
http://secunia.com/advisories/22116 cve-icon cve-icon
http://secunia.com/advisories/22130 cve-icon cve-icon
http://secunia.com/advisories/22165 cve-icon cve-icon
http://secunia.com/advisories/22166 cve-icon cve-icon
http://secunia.com/advisories/22172 cve-icon cve-icon
http://secunia.com/advisories/22186 cve-icon cve-icon
http://secunia.com/advisories/22193 cve-icon cve-icon
http://secunia.com/advisories/22207 cve-icon cve-icon
http://secunia.com/advisories/22212 cve-icon cve-icon
http://secunia.com/advisories/22216 cve-icon cve-icon
http://secunia.com/advisories/22220 cve-icon cve-icon
http://secunia.com/advisories/22240 cve-icon cve-icon
http://secunia.com/advisories/22259 cve-icon cve-icon
http://secunia.com/advisories/22260 cve-icon cve-icon
http://secunia.com/advisories/22284 cve-icon cve-icon
http://secunia.com/advisories/22298 cve-icon cve-icon
http://secunia.com/advisories/22330 cve-icon cve-icon
http://secunia.com/advisories/22385 cve-icon cve-icon
http://secunia.com/advisories/22460 cve-icon cve-icon
http://secunia.com/advisories/22487 cve-icon cve-icon
http://secunia.com/advisories/22500 cve-icon cve-icon
http://secunia.com/advisories/22544 cve-icon cve-icon
http://secunia.com/advisories/22626 cve-icon cve-icon
http://secunia.com/advisories/22671 cve-icon cve-icon
http://secunia.com/advisories/22758 cve-icon cve-icon
http://secunia.com/advisories/22772 cve-icon cve-icon
http://secunia.com/advisories/22799 cve-icon cve-icon
http://secunia.com/advisories/23038 cve-icon cve-icon
http://secunia.com/advisories/23155 cve-icon cve-icon
http://secunia.com/advisories/23280 cve-icon cve-icon
http://secunia.com/advisories/23309 cve-icon cve-icon
http://secunia.com/advisories/23340 cve-icon cve-icon
http://secunia.com/advisories/23351 cve-icon cve-icon
http://secunia.com/advisories/23680 cve-icon cve-icon
http://secunia.com/advisories/23794 cve-icon cve-icon
http://secunia.com/advisories/23915 cve-icon cve-icon
http://secunia.com/advisories/24930 cve-icon cve-icon
http://secunia.com/advisories/24950 cve-icon cve-icon
http://secunia.com/advisories/25889 cve-icon cve-icon
http://secunia.com/advisories/26329 cve-icon cve-icon
http://secunia.com/advisories/26893 cve-icon cve-icon
http://secunia.com/advisories/30124 cve-icon cve-icon
http://secunia.com/advisories/31492 cve-icon cve-icon
http://secunia.com/advisories/31531 cve-icon cve-icon
http://security.freebsd.org/advisories/FreeBSD-SA-06:23.openssl.asc cve-icon cve-icon
http://security.gentoo.org/glsa/glsa-200610-11.xml cve-icon cve-icon
http://securitytracker.com/id?1016943 cve-icon cve-icon
http://securitytracker.com/id?1017522 cve-icon cve-icon
http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.676946 cve-icon cve-icon
http://sourceforge.net/project/shownotes.php?release_id=461863&group_id=69227 cve-icon cve-icon
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102668-1 cve-icon cve-icon
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102747-1 cve-icon cve-icon
http://sunsolve.sun.com/search/document.do?assetkey=1-66-200585-1 cve-icon cve-icon
http://sunsolve.sun.com/search/document.do?assetkey=1-66-201534-1 cve-icon cve-icon
http://support.attachmate.com/techdocs/2374.html cve-icon cve-icon
http://support.avaya.com/elmodocs2/security/ASA-2006-220.htm cve-icon cve-icon
http://support.avaya.com/elmodocs2/security/ASA-2006-260.htm cve-icon cve-icon
http://www.arkoon.fr/upload/alertes/37AK-2006-06-FR-1.1_FAST360_OPENSSL_ASN1.pdf cve-icon cve-icon
http://www.arkoon.fr/upload/alertes/41AK-2006-08-FR-1.1_SSL360_OPENSSL_ASN1.pdf cve-icon cve-icon
http://www.cisco.com/en/US/products/hw/contnetw/ps4162/tsd_products_security_response09186a008077af1b.html cve-icon cve-icon
http://www.cisco.com/warp/public/707/cisco-sr-20061108-openssl.shtml cve-icon cve-icon
http://www.debian.org/security/2006/dsa-1185 cve-icon cve-icon
http://www.debian.org/security/2006/dsa-1195 cve-icon cve-icon
http://www.gentoo.org/security/en/glsa/glsa-200612-11.xml cve-icon cve-icon
http://www.mandriva.com/security/advisories?name=MDKSA-2006:172 cve-icon cve-icon
http://www.mandriva.com/security/advisories?name=MDKSA-2006:177 cve-icon cve-icon
http://www.mandriva.com/security/advisories?name=MDKSA-2006:178 cve-icon cve-icon
http://www.novell.com/linux/security/advisories/2006_24_sr.html cve-icon cve-icon
http://www.novell.com/linux/security/advisories/2006_58_openssl.html cve-icon cve-icon
http://www.openpkg.org/security/advisories/OpenPKG-SA-2006.021-openssl.html cve-icon cve-icon
http://www.openssl.org/news/secadv_20060928.txt cve-icon cve-icon
http://www.oracle.com/technetwork/topics/security/cpujan2007-101493.html cve-icon cve-icon
http://www.osvdb.org/29261 cve-icon cve-icon
http://www.redhat.com/support/errata/RHSA-2006-0695.html cve-icon cve-icon
http://www.redhat.com/support/errata/RHSA-2008-0629.html cve-icon cve-icon
http://www.securityfocus.com/archive/1/447318/100/0/threaded cve-icon cve-icon
http://www.securityfocus.com/archive/1/447393/100/0/threaded cve-icon cve-icon
http://www.securityfocus.com/archive/1/456546/100/200/threaded cve-icon cve-icon
http://www.securityfocus.com/archive/1/489739/100/0/threaded cve-icon cve-icon
http://www.securityfocus.com/bid/20247 cve-icon cve-icon
http://www.securityfocus.com/bid/22083 cve-icon cve-icon
http://www.securityfocus.com/bid/28276 cve-icon cve-icon
http://www.serv-u.com/releasenotes/ cve-icon cve-icon
http://www.trustix.org/errata/2006/0054 cve-icon cve-icon
http://www.ubuntu.com/usn/usn-353-1 cve-icon cve-icon
http://www.ubuntu.com/usn/usn-353-2 cve-icon cve-icon
http://www.uniras.gov.uk/niscc/docs/re-20060928-00661.pdf?lang=en cve-icon cve-icon
http://www.us-cert.gov/cas/techalerts/TA06-333A.html cve-icon cve-icon
http://www.vmware.com/security/advisories/VMSA-2008-0005.html cve-icon cve-icon
http://www.vmware.com/support/ace2/doc/releasenotes_ace2.html cve-icon cve-icon
http://www.vmware.com/support/esx2/doc/esx-202-200612-patch.html cve-icon cve-icon
http://www.vmware.com/support/esx21/doc/esx-213-200612-patch.html cve-icon cve-icon
http://www.vmware.com/support/esx25/doc/esx-253-200612-patch.html cve-icon cve-icon
http://www.vmware.com/support/esx25/doc/esx-254-200612-patch.html cve-icon cve-icon
http://www.vmware.com/support/player/doc/releasenotes_player.html cve-icon cve-icon
http://www.vmware.com/support/player2/doc/releasenotes_player2.html cve-icon cve-icon
http://www.vmware.com/support/server/doc/releasenotes_server.html cve-icon cve-icon
http://www.vmware.com/support/vi3/doc/esx-3069097-patch.html cve-icon cve-icon
http://www.vmware.com/support/vi3/doc/esx-9986131-patch.html cve-icon cve-icon
http://www.vmware.com/support/ws55/doc/releasenotes_ws55.html cve-icon cve-icon
http://www.vmware.com/support/ws6/doc/releasenotes_ws6.html cve-icon cve-icon
http://www.vupen.com/english/advisories/2006/3820 cve-icon cve-icon
http://www.vupen.com/english/advisories/2006/3860 cve-icon cve-icon
http://www.vupen.com/english/advisories/2006/3869 cve-icon cve-icon
http://www.vupen.com/english/advisories/2006/3902 cve-icon cve-icon
http://www.vupen.com/english/advisories/2006/3936 cve-icon cve-icon
http://www.vupen.com/english/advisories/2006/4019 cve-icon cve-icon
http://www.vupen.com/english/advisories/2006/4036 cve-icon cve-icon
http://www.vupen.com/english/advisories/2006/4264 cve-icon cve-icon
http://www.vupen.com/english/advisories/2006/4327 cve-icon cve-icon
http://www.vupen.com/english/advisories/2006/4329 cve-icon cve-icon
http://www.vupen.com/english/advisories/2006/4401 cve-icon cve-icon
http://www.vupen.com/english/advisories/2006/4417 cve-icon cve-icon
http://www.vupen.com/english/advisories/2006/4750 cve-icon cve-icon
http://www.vupen.com/english/advisories/2006/4980 cve-icon cve-icon
http://www.vupen.com/english/advisories/2007/0343 cve-icon cve-icon
http://www.vupen.com/english/advisories/2007/1401 cve-icon cve-icon
http://www.vupen.com/english/advisories/2007/2315 cve-icon cve-icon
http://www.vupen.com/english/advisories/2007/2783 cve-icon cve-icon
http://www.vupen.com/english/advisories/2008/0905/references cve-icon cve-icon
http://www.vupen.com/english/advisories/2008/2396 cve-icon cve-icon
http://www.xerox.com/downloads/usa/en/c/cert_ESSNetwork_XRX07001_v1.pdf cve-icon cve-icon
https://exchange.xforce.ibmcloud.com/vulnerabilities/29230 cve-icon cve-icon
https://issues.rpath.com/browse/RPL-1633 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2006-2940 cve-icon
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10311 cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2006-2940 cve-icon
https://www2.itrc.hp.com/service/cki/docDisplay.do?docId=c00967144 cve-icon cve-icon
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2006-09-28T18:00:00

Updated: 2024-08-07T18:06:27.233Z

Reserved: 2006-06-09T00:00:00

Link: CVE-2006-2940

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2006-09-28T18:07:00.000

Modified: 2024-11-21T00:12:26.963

Link: CVE-2006-2940

cve-icon Redhat

Severity : Moderate

Publid Date: 2006-09-28T00:00:00Z

Links: CVE-2006-2940 - Bugzilla