4.3 - HPSBUX02165 SSRT061266

Executive Summary

Summary
Title	HP-UX VirtualVault Remote Unauthorized Access

Informations
Name	HPSBUX02165 SSRT061266	First vendor Publication	2006-10-31
Vendor	HP	Last vendor Modification	2006-10-31
Severity (Vendor)	N/A	Revision	1

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:P/I:N/A:N)
Cvss Base Score	4.3	Attack Range	Network
Cvss Impact Score	2.9	Attack Complexity	Medium
Cvss Expoit Score	8.6	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

A security vulnerability has been identified in OpenSSL used in HP VirtualVault 4.7, 4.6, 4.5 and HP WebProxy that may allow remote unauthorized access.

Original Source

Url : http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00794048

CAPEC : Common Attack Pattern Enumeration & Classification

Id	Name
CAPEC-96	Block Access to Libraries

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-310	Cryptographic Issues

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:11656

Oval ID:	oval:org.mitre.oval:def:11656
Title:	OpenSSL before 0.9.7, 0.9.7 before 0.9.7k, and 0.9.8 before 0.9.8c, when using an RSA key with exponent 3, removes PKCS-1 padding before generating a hash, which allows remote attackers to forge a PKCS #1 v1.5 signature that is signed by that RSA key and prevents OpenSSL from correctly verifying X.509 and other certificates that use PKCS #1.
Description:	OpenSSL before 0.9.7, 0.9.7 before 0.9.7k, and 0.9.8 before 0.9.8c, when using an RSA key with exponent 3, removes PKCS-1 padding before generating a hash, which allows remote attackers to forge a PKCS #1 v1.5 signature that is signed by that RSA key and prevents OpenSSL from correctly verifying X.509 and other certificates that use PKCS #1.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2006-4339	Version:	3
Platform(s):	Red Hat Enterprise Linux 3 Red Hat Enterprise Linux 4 Red Hat Enterprise Linux Extras 3 Red Hat Enterprise Linux Extras 4	Product(s):
Definition Synopsis:
IF The operating system installed on the system is Red Hat Enterprise Linux 3 AND openssl-perl is earlier than 0:0.9.7a-33.18 AND openssl-devel is earlier than 0:0.9.7a-33.18 AND openssl is earlier than 0:0.9.7a-33.18 AND openssl096b is earlier than 0:0.9.6b-16.43 OR The operating system installed on the system is Red Hat Enterprise Linux 4 AND openssl-perl is earlier than 0:0.9.7a-43.11 AND openssl-devel is earlier than 0:0.9.7a-43.11 AND openssl is earlier than 0:0.9.7a-43.11 AND openssl096b is earlier than 0:0.9.6b-22.43 OR redhat-release is version 3 AND java-1.4.2-ibm-plugin is earlier than 0:1.4.2.7-1jpp.4.el3 AND java-1.4.2-ibm-jdbc is earlier than 0:1.4.2.7-1jpp.4.el3 AND java-1.4.2-ibm-devel is earlier than 0:1.4.2.7-1jpp.4.el3 AND java-1.4.2-ibm is earlier than 0:1.4.2.7-1jpp.4.el3 AND java-1.4.2-ibm-src is earlier than 0:1.4.2.7-1jpp.4.el3 AND java-1.4.2-ibm-demo is earlier than 0:1.4.2.7-1jpp.4.el3 OR redhat-release is version 4 AND java-1.5.0-ibm-javacomm is earlier than 1:1.5.0.3-1jpp.3.el4 AND java-1.5.0-ibm-devel is earlier than 1:1.5.0.3-1jpp.3.el4 AND java-1.5.0-ibm-src is earlier than 1:1.5.0.3-1jpp.3.el4 AND java-1.5.0-ibm-demo is earlier than 1:1.5.0.3-1jpp.3.el4 AND java-1.4.2-ibm-devel is earlier than 0:1.4.2.7-1jpp.4.el4 AND java-1.4.2-ibm is earlier than 0:1.4.2.7-1jpp.4.el4 AND java-1.4.2-ibm-src is earlier than 0:1.4.2.7-1jpp.4.el4 AND java-1.4.2-ibm-javacomm is earlier than 0:1.4.2.7-1jpp.4.el4 AND java-1.5.0-ibm is earlier than 1:1.5.0.3-1jpp.3.el4 AND java-1.4.2-ibm-plugin is earlier than 0:1.4.2.7-1jpp.4.el4 AND java-1.5.0-ibm-plugin is earlier than 1:1.5.0.3-1jpp.3.el4 AND java-1.5.0-ibm-jdbc is earlier than 1:1.5.0.3-1jpp.3.el4 AND java-1.4.2-ibm-jdbc is earlier than 0:1.4.2.7-1jpp.4.el4 AND java-1.4.2-ibm-demo is earlier than 0:1.4.2.7-1jpp.4.el4

CPE : Common Platform Enumeration

Type	Description	Count
Application	Openssl cpe:2.3:a:openssl:openssl:0.9.8b:::::::* cpe:2.3:a:openssl:openssl:0.9.8a:::::::* cpe:2.3:a:openssl:openssl:0.9.8:-:::::: cpe:2.3:a:openssl:openssl:0.9.7m:::::::* cpe:2.3:a:openssl:openssl:0.9.7m::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.7m::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.7m::::::x86: cpe:2.3:a:openssl:openssl:0.9.7l:::::::* cpe:2.3:a:openssl:openssl:0.9.7l::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.7l::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.7l::::::x86: cpe:2.3:a:openssl:openssl:0.9.7k:::::::* cpe:2.3:a:openssl:openssl:0.9.7k::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.7k::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.7k::::::x86: cpe:2.3:a:openssl:openssl:0.9.7j:::::::* cpe:2.3:a:openssl:openssl:0.9.7j::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.7j::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.7j::::::x86: cpe:2.3:a:openssl:openssl:0.9.7i:::::::* cpe:2.3:a:openssl:openssl:0.9.7i::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.7i::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.7i::::::x86: cpe:2.3:a:openssl:openssl:0.9.7h:::::::* cpe:2.3:a:openssl:openssl:0.9.7h::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.7h::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.7h::::::x86: cpe:2.3:a:openssl:openssl:0.9.7g:::::::* cpe:2.3:a:openssl:openssl:0.9.7g::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.7g::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.7g::::::x86: cpe:2.3:a:openssl:openssl:0.9.7f:::::::* cpe:2.3:a:openssl:openssl:0.9.7f::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.7f::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.7f::::::x86: cpe:2.3:a:openssl:openssl:0.9.7e:::::::* cpe:2.3:a:openssl:openssl:0.9.7e::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.7e::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.7e::::::x86: cpe:2.3:a:openssl:openssl:0.9.7d:::::::* cpe:2.3:a:openssl:openssl:0.9.7d::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.7d::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.7d::::::x86: cpe:2.3:a:openssl:openssl:0.9.7c:::::::* cpe:2.3:a:openssl:openssl:0.9.7c::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.7c::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.7c::::::x86: cpe:2.3:a:openssl:openssl:0.9.7b:::::::* cpe:2.3:a:openssl:openssl:0.9.7b::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.7b::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.7b::::::x86: cpe:2.3:a:openssl:openssl:0.9.7a:::::::* cpe:2.3:a:openssl:openssl:0.9.7a::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.7a::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.7a::::::x86: cpe:2.3:a:openssl:openssl:0.9.7:beta3:::::: cpe:2.3:a:openssl:openssl:0.9.7:beta1:::::: cpe:2.3:a:openssl:openssl:0.9.7:-:::::: cpe:2.3:a:openssl:openssl:0.9.7:beta5:::::: cpe:2.3:a:openssl:openssl:0.9.7:beta6:::::: cpe:2.3:a:openssl:openssl:0.9.7:beta4:::::: cpe:2.3:a:openssl:openssl:0.9.7:beta2:::::: cpe:2.3:a:openssl:openssl:0.9.7:beta2:%7E%7E%7E%7Ex86%7E:::::* cpe:2.3:a:openssl:openssl:0.9.7:beta4:%7E%7E%7E%7Ex86%7E:::::* cpe:2.3:a:openssl:openssl:0.9.7:beta1:%7E%7E%7E%7Ex86%7E:::::* cpe:2.3:a:openssl:openssl:0.9.7:beta5:%7E%7E%7E%7Ex86%7E:::::* cpe:2.3:a:openssl:openssl:0.9.7:beta3:%7E%7E%7E%7Ex86%7E:::::* cpe:2.3:a:openssl:openssl:0.9.7::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.7:beta6:%7E%7E%7E%7Ex86%7E:::::* cpe:2.3:a:openssl:openssl:0.9.7:beta5:~~~~x86~:::::* cpe:2.3:a:openssl:openssl:0.9.7:beta4:~~~~x86~:::::* cpe:2.3:a:openssl:openssl:0.9.7:beta6:~~~~x86~:::::* cpe:2.3:a:openssl:openssl:0.9.7:beta1:~~~~x86~:::::* cpe:2.3:a:openssl:openssl:0.9.7:beta3:~~~~x86~:::::* cpe:2.3:a:openssl:openssl:0.9.7:beta2:~~~~x86~:::::* cpe:2.3:a:openssl:openssl:0.9.7::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.7::::::x86: cpe:2.3:a:openssl:openssl:0.9.7:beta1:::::x86:* cpe:2.3:a:openssl:openssl:0.9.7:beta2:::::x86:* cpe:2.3:a:openssl:openssl:0.9.7:beta3:::::x86:* cpe:2.3:a:openssl:openssl:0.9.7:beta4:::::x86:* cpe:2.3:a:openssl:openssl:0.9.7:beta5:::::x86:* cpe:2.3:a:openssl:openssl:0.9.7:beta6:::::x86:* cpe:2.3:a:openssl:openssl:0.9.6m:::::::* cpe:2.3:a:openssl:openssl:0.9.6m::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.6m::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.6m::::::x86: cpe:2.3:a:openssl:openssl:0.9.6l:::::::* cpe:2.3:a:openssl:openssl:0.9.6l::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.6l::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.6l::::::x86: cpe:2.3:a:openssl:openssl:0.9.6k:::::::* cpe:2.3:a:openssl:openssl:0.9.6k::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.6k::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.6k::::::x86: cpe:2.3:a:openssl:openssl:0.9.6j:::::::* cpe:2.3:a:openssl:openssl:0.9.6j::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.6j::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.6j::::::x86: cpe:2.3:a:openssl:openssl:0.9.6i:::::::* cpe:2.3:a:openssl:openssl:0.9.6i::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.6i::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.6i::::::x86: cpe:2.3:a:openssl:openssl:0.9.6h:::::::* cpe:2.3:a:openssl:openssl:0.9.6h:bogus:::::: cpe:2.3:a:openssl:openssl:0.9.6h::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.6h::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.6h::::::x86: cpe:2.3:a:openssl:openssl:0.9.6g:::::::* cpe:2.3:a:openssl:openssl:0.9.6g::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.6g::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.6g::::::x86: cpe:2.3:a:openssl:openssl:0.9.6f:::::::* cpe:2.3:a:openssl:openssl:0.9.6f::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.6f::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.6f::::::x86: cpe:2.3:a:openssl:openssl:0.9.6e:::::::* cpe:2.3:a:openssl:openssl:0.9.6e::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.6e::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.6e::::::x86: cpe:2.3:a:openssl:openssl:0.9.6d:-:::::: cpe:2.3:a:openssl:openssl:0.9.6d::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.6d::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.6d::::::x86: cpe:2.3:a:openssl:openssl:0.9.6c:::::::* cpe:2.3:a:openssl:openssl:0.9.6c::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.6c::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.6c::::::x86: cpe:2.3:a:openssl:openssl:0.9.6b:::::::* cpe:2.3:a:openssl:openssl:0.9.6b::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.6b::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.6b::::::x86: cpe:2.3:a:openssl:openssl:0.9.6a:-:::::: cpe:2.3:a:openssl:openssl:0.9.6a:beta2:::::: cpe:2.3:a:openssl:openssl:0.9.6a:beta1:::::: cpe:2.3:a:openssl:openssl:0.9.6a:beta3:::::: cpe:2.3:a:openssl:openssl:0.9.6a:beta2:%7E%7E%7E%7Ex86%7E:::::* cpe:2.3:a:openssl:openssl:0.9.6a::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.6a:beta3:%7E%7E%7E%7Ex86%7E:::::* cpe:2.3:a:openssl:openssl:0.9.6a:beta1:%7E%7E%7E%7Ex86%7E:::::* cpe:2.3:a:openssl:openssl:0.9.6a:beta1:~~~~x86~:::::* cpe:2.3:a:openssl:openssl:0.9.6a:beta2:~~~~x86~:::::* cpe:2.3:a:openssl:openssl:0.9.6a:beta3:~~~~x86~:::::* cpe:2.3:a:openssl:openssl:0.9.6a::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.6a::::::x86: cpe:2.3:a:openssl:openssl:0.9.6a:beta1:::::x86:* cpe:2.3:a:openssl:openssl:0.9.6a:beta2:::::x86:* cpe:2.3:a:openssl:openssl:0.9.6a:beta3:::::x86:* cpe:2.3:a:openssl:openssl:0.9.6:beta2:::::: cpe:2.3:a:openssl:openssl:0.9.6:-:::::: cpe:2.3:a:openssl:openssl:0.9.6:beta3:::::: cpe:2.3:a:openssl:openssl:0.9.6:beta1:::::: cpe:2.3:a:openssl:openssl:0.9.6:beta2:%7E%7E%7E%7Ex86%7E:::::* cpe:2.3:a:openssl:openssl:0.9.6::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.6:beta1:%7E%7E%7E%7Ex86%7E:::::* cpe:2.3:a:openssl:openssl:0.9.6:beta3:%7E%7E%7E%7Ex86%7E:::::* cpe:2.3:a:openssl:openssl:0.9.6:beta1:~~~~x86~:::::* cpe:2.3:a:openssl:openssl:0.9.6:beta3:~~~~x86~:::::* cpe:2.3:a:openssl:openssl:0.9.6:beta2:~~~~x86~:::::* cpe:2.3:a:openssl:openssl:0.9.6::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.6::::::x86: cpe:2.3:a:openssl:openssl:0.9.6:beta1:::::x86:* cpe:2.3:a:openssl:openssl:0.9.6:beta2:::::x86:* cpe:2.3:a:openssl:openssl:0.9.6:beta3:::::x86:* cpe:2.3:a:openssl:openssl:0.9.5a:beta2:::::: cpe:2.3:a:openssl:openssl:0.9.5a:beta1:::::: cpe:2.3:a:openssl:openssl:0.9.5a:-:::::: cpe:2.3:a:openssl:openssl:0.9.5a:beta2:%7E%7E%7E%7Ex86%7E:::::* cpe:2.3:a:openssl:openssl:0.9.5a::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.5a:beta1:%7E%7E%7E%7Ex86%7E:::::* cpe:2.3:a:openssl:openssl:0.9.5a::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.5a:beta1:~~~~x86~:::::* cpe:2.3:a:openssl:openssl:0.9.5a:beta2:~~~~x86~:::::* cpe:2.3:a:openssl:openssl:0.9.5a::::::x86: cpe:2.3:a:openssl:openssl:0.9.5a:beta1:::::x86:* cpe:2.3:a:openssl:openssl:0.9.5a:beta2:::::x86:* cpe:2.3:a:openssl:openssl:0.9.5:beta1:::::: cpe:2.3:a:openssl:openssl:0.9.5:-:::::: cpe:2.3:a:openssl:openssl:0.9.5:beta2:::::: cpe:2.3:a:openssl:openssl:0.9.5:beta2:%7E%7E%7E%7Ex86%7E:::::* cpe:2.3:a:openssl:openssl:0.9.5:beta1:%7E%7E%7E%7Ex86%7E:::::* cpe:2.3:a:openssl:openssl:0.9.5::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.5:beta1:~~~~x86~:::::* cpe:2.3:a:openssl:openssl:0.9.5:beta2:~~~~x86~:::::* cpe:2.3:a:openssl:openssl:0.9.5::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.5::::::x86: cpe:2.3:a:openssl:openssl:0.9.5:beta1:::::x86:* cpe:2.3:a:openssl:openssl:0.9.5:beta2:::::x86:* cpe:2.3:a:openssl:openssl:0.9.4:::::::* cpe:2.3:a:openssl:openssl:0.9.4::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.4::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.4::::::x86: cpe:2.3:a:openssl:openssl:0.9.3a:::::::* cpe:2.3:a:openssl:openssl:0.9.3a::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.3a::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.3a::::::x86: cpe:2.3:a:openssl:openssl:0.9.3:-:::::: cpe:2.3:a:openssl:openssl:0.9.3::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.3::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.3::::::x86: cpe:2.3:a:openssl:openssl:0.9.2b:::::::* cpe:2.3:a:openssl:openssl:0.9.2b::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.2b::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.2b::::::x86: cpe:2.3:a:openssl:openssl:0.9.1c:::::::* cpe:2.3:a:openssl:openssl:0.9.1c::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.1c::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.1c::::::x86: cpe:2.3:a:openssl:openssl:0.9.1b:::::::* cpe:2.3:a:openssl:openssl:0.9.0b:::::::* cpe:2.3:a:openssl:openssl:::::::: cpe:2.3:a:openssl:openssl:::openvms:::::* cpe:2.3:a:openssl:openssl:-:::::::*	213

OpenVAS Exploits

Date	Description
2010-03-16	Name : FreeBSD Ports: openoffice.org File : nvt/freebsd_openoffice.org.nasl
2010-02-03	Name : Solaris Update for Kernel 122300-48 File : nvt/gb_solaris_122300_48.nasl
2010-02-03	Name : Solaris Update for Kernel 122301-48 File : nvt/gb_solaris_122301_48.nasl
2009-11-17	Name : Mac OS X Version File : nvt/macosx_version.nasl
2009-10-13	Name : Solaris Update for Kernel 122300-44 File : nvt/gb_solaris_122300_44.nasl
2009-10-13	Name : Solaris Update for /usr/bin/ssh 114357-18 File : nvt/gb_solaris_114357_18.nasl
2009-10-13	Name : Solaris Update for /usr/bin/ssh 114356-19 File : nvt/gb_solaris_114356_19.nasl
2009-10-13	Name : Solaris Update for Kernel 122301-44 File : nvt/gb_solaris_122301_44.nasl
2009-10-13	Name : Solaris Update for pkg utilities 113713-28 File : nvt/gb_solaris_113713_28.nasl
2009-10-10	Name : SLES9: Security update for openssl File : nvt/sles9p5020640.nasl
2009-10-10	Name : SLES9: Security update for bind File : nvt/sles9p5015338.nasl
2009-09-23	Name : Solaris Update for Kernel 122301-42 File : nvt/gb_solaris_122301_42.nasl
2009-09-23	Name : Solaris Update for pkg utilities 114568-27 File : nvt/gb_solaris_114568_27.nasl
2009-06-03	Name : Solaris Update for wanboot 122715-02 File : nvt/gb_solaris_122715_02.nasl
2009-06-03	Name : Solaris Update for bootconfchk 123376-01 File : nvt/gb_solaris_123376_01.nasl
2009-06-03	Name : Solaris Update for bootconfchk 123377-01 File : nvt/gb_solaris_123377_01.nasl
2009-06-03	Name : Solaris Update for kernel 127127-11 File : nvt/gb_solaris_127127_11.nasl
2009-06-03	Name : Solaris Update for Kernel 122301-40 File : nvt/gb_solaris_122301_40.nasl
2009-06-03	Name : Solaris Update for kernel 127128-11 File : nvt/gb_solaris_127128_11.nasl
2009-06-03	Name : Solaris Update for kernel 120011-14 File : nvt/gb_solaris_120011_14.nasl
2009-06-03	Name : Solaris Update for Kernel 122300-40 File : nvt/gb_solaris_122300_40.nasl
2009-06-03	Name : Solaris Update for wanboot 117123-08 File : nvt/gb_solaris_117123_08.nasl
2009-06-03	Name : Solaris Update for pkg utilities 114568-26 File : nvt/gb_solaris_114568_26.nasl
2009-06-03	Name : Solaris Update for /usr/bin/ssh 114357-17 File : nvt/gb_solaris_114357_17.nasl
2009-06-03	Name : Solaris Update for /usr/bin/ssh 114356-18 File : nvt/gb_solaris_114356_18.nasl
2009-06-03	Name : Solaris Update for NSPR 4.1.6 / NSS 3.3.4.8 114049-14 File : nvt/gb_solaris_114049_14.nasl
2009-06-03	Name : Solaris Update for pkg utilities 113713-27 File : nvt/gb_solaris_113713_27.nasl
2009-05-05	Name : HP-UX Update for BIND HPSBUX02219 File : nvt/gb_hp_ux_HPSBUX02219.nasl
2009-05-05	Name : HP-UX Update for Apache Remote Execution of Arbitrary Code HPSBUX02186 File : nvt/gb_hp_ux_HPSBUX02186.nasl
2009-01-28	Name : SuSE Update for IBMJava2 SUSE-SA:2007:010 File : nvt/gb_suse_2007_010.nasl
2008-09-24	Name : Gentoo Security Advisory GLSA 200610-06 (nss) File : nvt/glsa_200610_06.nasl
2008-09-24	Name : Gentoo Security Advisory GLSA 200609-18 (opera) File : nvt/glsa_200609_18.nasl
2008-09-24	Name : Gentoo Security Advisory GLSA 200609-05 (openssl) File : nvt/glsa_200609_05.nasl
2008-09-04	Name : FreeBSD Security Advisory (FreeBSD-SA-06:19.openssl.asc) File : nvt/freebsdsa_openssl3.nasl
2008-09-04	Name : FreeBSD Ports: openssl File : nvt/freebsd_openssl1.nasl
2008-09-04	Name : FreeBSD Ports: opera, opera-devel, linux-opera File : nvt/freebsd_opera2.nasl
2008-01-17	Name : Debian Security Advisory DSA 1173-1 (openssl) File : nvt/deb_1173_1.nasl
2008-01-17	Name : Debian Security Advisory DSA 1174-1 (openssl096) File : nvt/deb_1174_1.nasl
0000-00-00	Name : Slackware Advisory SSA:2006-310-01 bind File : nvt/esoft_slk_ssa_2006_310_01.nasl
0000-00-00	Name : Slackware Advisory SSA:2006-257-02 openssl File : nvt/esoft_slk_ssa_2006_257_02.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
28549	OpenSSL RSA Key PKCS #1 v1.5 Signature Forgery OpenSSL contains a flaw that may allow a malicious user to bypass certain security restrictions. The issue is triggered due to an error within the verification of certain signatures, if an RSA key with exponent 3 is used it may be possible to forge a PKCS #1 v1.5 signature signed by that key. It is possible that the flaw may allow bypassing security restrictions resulting in a loss of integrity.

Description

28549

OpenSSL RSA Key PKCS #1 v1.5 Signature Forgery

OpenSSL contains a flaw that may allow a malicious user to bypass certain security restrictions. The issue is triggered due to an error within the verification of certain signatures, if an RSA key with exponent 3 is used it may be possible to forge a PKCS #1 v1.5 signature signed by that key. It is possible that the flaw may allow bypassing security restrictions resulting in a loss of integrity.

Nessus® Vulnerability Scanner

Date	Description
2014-10-10	Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL6623.nasl - Type : ACT_GATHER_INFO
2014-09-01	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201408-19.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2006-0661.nasl - Type : ACT_GATHER_INFO
2013-01-24	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-0073.nasl - Type : ACT_GATHER_INFO
2013-01-24	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-0062.nasl - Type : ACT_GATHER_INFO
2012-01-04	Name : The SSL layer on the remote server does not properly verify signatures. File : openssl_0_9_7k_0_9_8c.nasl - Type : ACT_GATHER_INFO
2011-05-28	Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2006-310-01.nasl - Type : ACT_GATHER_INFO
2010-03-01	Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_c97d7a37223311df96dd001b2134ef46.nasl - Type : ACT_GATHER_INFO
2010-02-12	Name : The remote Windows host has a program affected by multiple buffer overflows. File : openoffice_32.nasl - Type : ACT_GATHER_INFO
2010-01-10	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2008-0264.nasl - Type : ACT_GATHER_INFO
2010-01-10	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2008-0525.nasl - Type : ACT_GATHER_INFO
2010-01-10	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2008-0629.nasl - Type : ACT_GATHER_INFO
2008-04-02	Name : The remote Windows host has an application that is affected by multiple issues. File : vmware_multiple_vmsa_2008_0005.nasl - Type : ACT_GATHER_INFO
2007-12-17	Name : The remote host is affected by multiple vulnerabilities. File : macosx_java_rel6.nasl - Type : ACT_GATHER_INFO
2007-12-13	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_bind-2268.nasl - Type : ACT_GATHER_INFO
2007-12-13	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_compat-openssl097g-2163.nasl - Type : ACT_GATHER_INFO
2007-12-13	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_openssl-2082.nasl - Type : ACT_GATHER_INFO
2007-11-10	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-339-1.nasl - Type : ACT_GATHER_INFO
2007-10-17	Name : The remote openSUSE host is missing a security update. File : suse_compat-openssl097g-2171.nasl - Type : ACT_GATHER_INFO
2007-10-17	Name : The remote openSUSE host is missing a security update. File : suse_opera-2181.nasl - Type : ACT_GATHER_INFO
2007-10-17	Name : The remote openSUSE host is missing a security update. File : suse_openssl-2069.nasl - Type : ACT_GATHER_INFO
2007-10-17	Name : The remote openSUSE host is missing a security update. File : suse_bind-2269.nasl - Type : ACT_GATHER_INFO
2007-10-12	Name : The remote host is missing Sun Security Patch number 122715-03 File : solaris9_x86_122715.nasl - Type : ACT_GATHER_INFO
2007-09-25	Name : The remote host is missing Sun Security Patch number 117123-10 File : solaris9_117123.nasl - Type : ACT_GATHER_INFO
2007-09-25	Name : The remote HP-UX host is missing a security-related patch. File : hpux_PHNE_35920.nasl - Type : ACT_GATHER_INFO
2007-02-18	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-178.nasl - Type : ACT_GATHER_INFO
2007-02-18	Name : The remote host is missing a vendor-supplied security patch File : suse_SA_2006_061.nasl - Type : ACT_GATHER_INFO
2007-02-18	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-207.nasl - Type : ACT_GATHER_INFO
2007-02-18	Name : The remote host is missing a vendor-supplied security patch File : suse_SA_2006_055.nasl - Type : ACT_GATHER_INFO
2007-02-18	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-166.nasl - Type : ACT_GATHER_INFO
2007-02-18	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-177.nasl - Type : ACT_GATHER_INFO
2007-02-09	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-0072.nasl - Type : ACT_GATHER_INFO
2007-01-17	Name : The remote Fedora Core host is missing one or more security updates. File : fedora_2006-953.nasl - Type : ACT_GATHER_INFO
2007-01-17	Name : The remote Fedora Core host is missing a security update. File : fedora_2006-1004.nasl - Type : ACT_GATHER_INFO
2006-12-30	Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_077c2dca8f9a11dbab33000e0c2e438a.nasl - Type : ACT_GATHER_INFO
2006-12-16	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-161.nasl - Type : ACT_GATHER_INFO
2006-11-22	Name : The remote HP-UX host is missing a security-related patch. File : hpux_PHSS_35460.nasl - Type : ACT_GATHER_INFO
2006-11-22	Name : The remote HP-UX host is missing a security-related patch. File : hpux_PHSS_35110.nasl - Type : ACT_GATHER_INFO
2006-11-22	Name : The remote HP-UX host is missing a security-related patch. File : hpux_PHSS_35111.nasl - Type : ACT_GATHER_INFO
2006-11-22	Name : The remote HP-UX host is missing a security-related patch. File : hpux_PHSS_35436.nasl - Type : ACT_GATHER_INFO
2006-11-22	Name : The remote HP-UX host is missing a security-related patch. File : hpux_PHSS_35437.nasl - Type : ACT_GATHER_INFO
2006-11-22	Name : The remote HP-UX host is missing a security-related patch. File : hpux_PHSS_35458.nasl - Type : ACT_GATHER_INFO
2006-11-22	Name : The remote HP-UX host is missing a security-related patch. File : hpux_PHSS_35459.nasl - Type : ACT_GATHER_INFO
2006-11-22	Name : The remote HP-UX host is missing a security-related patch. File : hpux_PHSS_35461.nasl - Type : ACT_GATHER_INFO
2006-11-22	Name : The remote HP-UX host is missing a security-related patch. File : hpux_PHSS_35462.nasl - Type : ACT_GATHER_INFO
2006-11-22	Name : The remote HP-UX host is missing a security-related patch. File : hpux_PHSS_35463.nasl - Type : ACT_GATHER_INFO
2006-11-22	Name : The remote HP-UX host is missing a security-related patch. File : hpux_PHSS_35480.nasl - Type : ACT_GATHER_INFO
2006-11-22	Name : The remote HP-UX host is missing a security-related patch. File : hpux_PHSS_35481.nasl - Type : ACT_GATHER_INFO
2006-11-06	Name : The remote host is missing Sun Security Patch number 116648-25 File : solaris10_116648.nasl - Type : ACT_GATHER_INFO
2006-11-06	Name : The remote host is missing Sun Security Patch number 114045-14 File : solaris8_114045.nasl - Type : ACT_GATHER_INFO
2006-11-06	Name : The remote host is missing Sun Security Patch number 116648-25 File : solaris8_116648.nasl - Type : ACT_GATHER_INFO
2006-11-06	Name : The remote host is missing Sun Security Patch number 119209-36 File : solaris8_119209.nasl - Type : ACT_GATHER_INFO
2006-11-06	Name : The remote host is missing Sun Security Patch number 116648-25 File : solaris9_116648.nasl - Type : ACT_GATHER_INFO
2006-10-20	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200610-06.nasl - Type : ACT_GATHER_INFO
2006-10-14	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1173.nasl - Type : ACT_GATHER_INFO
2006-10-14	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1174.nasl - Type : ACT_GATHER_INFO
2006-09-22	Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_1fe734bf4a0611dbb48d00508d6a62df.nasl - Type : ACT_GATHER_INFO
2006-09-15	Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2006-257-02.nasl - Type : ACT_GATHER_INFO
2006-09-12	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2006-0661.nasl - Type : ACT_GATHER_INFO
2006-09-12	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200609-05.nasl - Type : ACT_GATHER_INFO
2006-09-12	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2006-0661.nasl - Type : ACT_GATHER_INFO
2005-10-19	Name : The remote host is missing Sun Security Patch number 119214-36 File : solaris10_x86_119214.nasl - Type : ACT_GATHER_INFO
2005-10-19	Name : The remote host is missing Sun Security Patch number 119213-36 File : solaris10_119213.nasl - Type : ACT_GATHER_INFO
2005-10-05	Name : The remote host is missing Sun Security Patch number 119212-36 File : solaris9_x86_119212.nasl - Type : ACT_GATHER_INFO
2005-10-05	Name : The remote host is missing Sun Security Patch number 119211-36 File : solaris9_119211.nasl - Type : ACT_GATHER_INFO
2004-07-12	Name : The remote host is missing Sun Security Patch number 114050-14 File : solaris9_x86_114050.nasl - Type : ACT_GATHER_INFO
2004-07-12	Name : The remote host is missing Sun Security Patch number 114049-14 File : solaris9_114049.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.

Date	Informations
2014-02-17 11:38:24	Multiple Updates

Global Informations

Type	Count
Capec ID(s)	1
CWE ID(s)	2
Oval ID(s)	1
CPE ID(s)	213
osvdb(s)	1
Openvas Exploit(s)	40
Nessus® Exploit(s)	67

	Related
4.3	CVE-2006-4339
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 1 more Alert(s)

4.3 - HPSBUX02165 SSRT061266

Executive Summary

Security-Database Scoring CVSS v3

Security-Database Scoring CVSS v2

Detail

Original Source

CAPEC : Common Attack Pattern Enumeration & Classification

CWE : Common Weakness Enumeration

OVAL Definitions

CPE : Common Platform Enumeration

OpenVAS Exploits

Open Source Vulnerability Database (OSVDB)

Nessus® Vulnerability Scanner

Alert History

Global Informations

Open Standards

Other Databases

COMPANY

STANDARDS

RECENT POSTS

MENU