CVE-2006-5484 Weak cryptography in n/a
Remote attackers can forge PKCS #1 v1.5 signatures when RSA keys with exponent 3 are used, bypassing certificate verification in SSH Tectia products.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2006-5484?
CVE-2006-5484 is a medium-severity vulnerability in n/a, published on 24 Oct 2006. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SSH Tectia Client/Server/Connector 5.1.0 and earlier, Manager 2.2.0 and earlier, and other products, when using an RSA key with exponent 3, removes PKCS-1 padding before generating a hash, which allows remote attackers to forge a PKCS #1 v1.5 signature that is signed by that RSA key and prevents Tectia from correctly verifying X.509 and other certificates that use PKCS #1, a similar issue to CVE-2006-4339.
Which versions are affected by CVE-2006-5484?
It affects 4 products.
Products include Ssh Tectia Client, Ssh Tectia Connector, Ssh Tectia Manager, Ssh Tectia Server.
How do I fix CVE-2006-5484?
No fix has been published for CVE-2006-5484 yet. Limit exposure of the affected software until one is available.
Is CVE-2006-5484 being exploited?
There is no known exploitation of CVE-2006-5484 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-f6g8-8p5j-hphv.