CVE-2006-2940: High severity openssl openssl vulnerability
Published Sep 28, 2006
·Updated
OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions allows attackers to cause a denial of service (CPU consumption) via parasitic public keys with large (1) "public exponent" or (2) "public modulus" values in X.509 certificates that require extra time to process when using RSA signature verification.
Affected Software
47 affected components
OpenSSL OpenSSL=0.9.5a-beta2
OpenSSL OpenSSL=0.9.8b
OpenSSL OpenSSL=0.9.6i
OpenSSL OpenSSL=0.9.3
OpenSSL OpenSSL=0.9.8c
OpenSSL OpenSSL=0.9.7c
OpenSSL OpenSSL=0.9.5-beta1
OpenSSL OpenSSL=0.9.6d
OpenSSL OpenSSL=0.9.1c
OpenSSL OpenSSL=0.9.6
OpenSSL OpenSSL=0.9.7j
OpenSSL OpenSSL=0.9.6a
OpenSSL OpenSSL=0.9.4
OpenSSL OpenSSL=0.9.6a-beta2
OpenSSL OpenSSL=0.9.5a
OpenSSL OpenSSL=0.9.6f
OpenSSL OpenSSL=0.9.6-beta3
OpenSSL OpenSSL=0.9.6l
OpenSSL OpenSSL=0.9.7k
OpenSSL OpenSSL=0.9.7g
OpenSSL OpenSSL=0.9.6e
OpenSSL OpenSSL=0.9.7d
OpenSSL OpenSSL=0.9.7
OpenSSL OpenSSL=0.9.6b
OpenSSL OpenSSL=0.9.7e
OpenSSL OpenSSL=0.9.7b
OpenSSL OpenSSL=0.9.6a-beta1
OpenSSL OpenSSL=0.9.6k
OpenSSL OpenSSL=0.9.8a
OpenSSL OpenSSL=0.9.6g
OpenSSL OpenSSL=0.9.6-beta2
OpenSSL OpenSSL=0.9.3a
OpenSSL OpenSSL=0.9.6h
OpenSSL OpenSSL=0.9.7i
OpenSSL OpenSSL=0.9.7h
OpenSSL OpenSSL=0.9.6j
OpenSSL OpenSSL=0.9.8
OpenSSL OpenSSL=0.9.7a
OpenSSL OpenSSL=0.9.6c
OpenSSL OpenSSL=0.9.6-beta1
OpenSSL OpenSSL=0.9.6m
OpenSSL OpenSSL=0.9.5-beta2
OpenSSL OpenSSL=0.9.2b
OpenSSL OpenSSL=0.9.5
OpenSSL OpenSSL=0.9.5a-beta1
OpenSSL OpenSSL=0.9.6a-beta3
OpenSSL OpenSSL=0.9.7f
Event History
Sep 28, 2006
CVE Published
06:07 PM
Data Sourced
via NVD·06:07 PM
DescriptionSeverityWeaknessAffected Software
CVE Published
via MITRE·10:00 PM
Data Sourced
via MITRE·10:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2006-2940?
CVE-2006-2940 has been categorized as a moderate severity vulnerability.
2
How do I fix CVE-2006-2940?
To resolve CVE-2006-2940, upgrade OpenSSL to version 0.9.7l or later, or 0.9.8d or later.
3
What versions of OpenSSL are affected by CVE-2006-2940?
CVE-2006-2940 affects OpenSSL versions prior to 0.9.7l and 0.9.8d.
4
What type of attack does CVE-2006-2940 facilitate?
CVE-2006-2940 allows attackers to execute a denial of service attack that consumes excessive CPU resources.
5
Is there a workaround for CVE-2006-2940?
There are no known effective workarounds for CVE-2006-2940 aside from upgrading OpenSSL.