CVE-2006-3894
First published: Tue May 22 2007(Updated: )
The RSA Crypto-C before 6.3.1 and Cert-C before 2.8 libraries, as used by RSA BSAFE, multiple Cisco products, and other products, allows remote attackers to cause a denial of service via malformed ASN.1 objects.
Credit: cret@cert.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| BSAFE Cert-C | <=2.7 | |
| Dell BSAFE Crypto-C | <=6.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://jvn.jp/cert/JVNVU%23754281/index.html
- http://www.cisco.com/en/US/products/products_security_advisory09186a0080847c5d.shtml
- http://www.kb.cert.org/vuls/id/754281
- https://secure-support.novell.com/KanisaPlatform/Publishing/97/3590033_f.SAL_Public.html
- http://www.securityfocus.com/bid/24104
- http://www.securitytracker.com/id?1018095
- http://secunia.com/advisories/25364
- http://secunia.com/advisories/25399
- http://secunia.com/advisories/25343
- http://www.vupen.com/english/advisories/2007/1908
- http://www.vupen.com/english/advisories/2007/1909
- http://www.vupen.com/english/advisories/2007/1945
- http://osvdb.org/35338
- https://exchange.xforce.ibmcloud.com/vulnerabilities/34430
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5778
Frequently Asked Questions
What is the severity of CVE-2006-3894?
CVE-2006-3894 is classified as a critical vulnerability as it allows remote attackers to cause a denial of service.
How do I fix CVE-2006-3894?
To fix CVE-2006-3894, update to RSA BSAFE Crypto-C version 6.3.1 or later, and BSAFE Cert-C version 2.8 or later.
Which products are affected by CVE-2006-3894?
CVE-2006-3894 affects older versions of RSA BSAFE Crypto-C and Cert-C libraries integrated into various Cisco and Dell products.
What are the potential impacts of CVE-2006-3894?
The potential impact of CVE-2006-3894 is a denial of service, which could disrupt service availability for applications using the vulnerable libraries.
Is CVE-2006-3894 still relevant today?
While CVE-2006-3894 was reported in 2006, it remains relevant for organizations using unsupported versions of affected software.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/references
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- vendor/dell
- canonical/bsafe cert-c
- version/bsafe cert-c/2.7
- canonical/dell bsafe crypto-c
- version/dell bsafe crypto-c/6.3