// For flags

CVE-2006-7140

 

Severity Score

5.8
*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The libike library, as used by in.iked, elfsign, and kcfd in Sun Solaris 9 and 10, when using an RSA key with exponent 3, removes PKCS-1 padding before generating a hash, which allows remote attackers to forge a PKCS #1 v1.5 signature that is signed by that RSA key and prevents libike from correctly verifying X.509 and other certificates that use PKCS #1, a similar issue to CVE-2006-4339.

La biblioteca libike, tal y como se usa en in.iked, elfsign, y kcfd en Sun Solaris 9 y 10, cuando usan una clave RSA con exponente 3, borra caracterés de relleno PKCS-1 antes de genear la función resumen (hash), lo cual permite a atacantes remotos falsificar una firma PKCS #1 v1.5 que se ha firmado con esa clave RSA y evita a libike que verifique correctamente certificados X.509 y otros, que usen PKCS #1, vulnerabilidad similar a CVE-2006-4339.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
None
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2007-03-07 CVE Reserved
  • 2007-03-07 CVE Published
  • 2024-07-30 EPSS Updated
  • 2024-08-07 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Sun
Search vendor "Sun"
 Solaris
Search vendor "Sun" for product "Solaris"
 10.0
Search vendor "Sun" for product "Solaris" and version "10.0"
hw2
Affected
Sun
Search vendor "Sun"
 Sunos
Search vendor "Sun" for product "Sunos"
 5.9
Search vendor "Sun" for product "Sunos" and version "5.9"
-
Affected