CVE-2006-5201: Medium severity sun secure global desktop vulnerability

Published Oct 9, 2006

Updated

Multiple packages on Sun Solaris, including (1) NSS; (2) Java JDK and JRE 5.0 Update 8 and earlier, SDK and JRE 1.4.x up to 1.4.212, and SDK and JRE 1.3.x up to 1.3.119; (3) JSSE 1.0.303 and earlier; (4) IPSec/IKE; (5) Secure Global Desktop; and (6) StarOffice, when using an RSA key with exponent 3, removes PKCS-1 padding before generating a hash, which allows remote attackers to forge a PKCS #1 v1.5 signature that is signed by that RSA key and prevents these products from correctly verifying X.509 and other certificates that use PKCS #1.

Affected Software

95 affected components

Sun Secure Global Desktop

Sun NSS

Sun StarOffice

Sun SunOS=5.8

Sun Solaris Sparc=9.0

Sun Solaris Sparc=10.0

Sun JDK=1.5.0-update3

Sun JDK=1.5.0-update6

Sun JDK=1.5.0-update1

Sun JDK=1.5.0-update4

Sun JDK=1.5.0-update7

Sun JDK=1.5.0-update5

Sun JDK=1.5.0-update7_b03

Sun JDK=1.5.0-update2

Sun JDK=1.5.0-update8

Sun JDK=1.5.0

Sun JRE=1.4.2_7

Sun JRE=1.3.1_10

Sun JRE=1.3.1_06

Sun JRE=1.4.2_4

Sun JRE=1.4.2_2

Sun JRE=1.5.0-update2

Sun JRE=1.3.1_2

Sun JRE=1.4.2_1

Sun JRE=1.4.2_8

Sun JRE=1.3.1_16

Sun JRE=1.3.1_19

Sun JRE=1.5.0-update8

Sun JRE=1.3.1_11

Sun JRE=1.3.1_17

Sun JRE=1.4.2_12

Sun JRE=1.3.1_12

Sun JRE=1.3.1_03

Sun JRE=1.3.1_14

Sun JRE=1.3.1_08

Sun JRE=1.5.0-update7

Sun JRE=1.5.0-update3

Sun JRE=1.3.1_07

Sun JRE=1.3.1_05

Sun JRE=1.4.2_10

Sun JRE=1.5.0-update5

Sun JRE=1.4.2_9

Sun JRE=1.5.0-update6

Sun JRE=1.3.1_13

Sun JRE=1.3.1_04

Sun JRE=1.3.1_09

Sun JRE=1.4.2_11

Sun JRE=1.5.0-update1

Sun JRE=1.3.1_18

Sun JRE=1.3.1_15

Sun JRE=1.4.2_3

Sun JRE=1.5.0-update4

Sun JRE=1.4.2_5

Sun JRE=1.4.2_6

Sun JRE=1.5.0

Sun JRE=1.4.2

Sun JRE=1.3.1

Sun SDK=1.3.1_03

Sun SDK=1.4.2

Sun SDK=1.3.1_19

Sun SDK=1.3.1

Sun SDK=1.3.1_08

Sun SDK=1.4.2_10

Sun SDK=1.4.2_12

Sun SDK=1.3.1_15

Sun SDK=1.4.2_6

Sun SDK=1.3.1_07

Sun SDK=1.4.2_2

Sun SDK=1.3.1_10

Sun SDK=1.4.2_5

Sun SDK=1.3.1_06

Sun SDK=1.4.2_1

Sun SDK=1.3.1_12

Sun SDK=1.4.2_4

Sun SDK=1.3.1_17

Sun SDK=1.3.1_02

Sun SDK=1.3.1_18

Sun SDK=1.3.1_01

Sun SDK=1.3.1_16

Sun SDK=1.3.1_01a

Sun SDK=1.3.1_14

Sun SDK=1.4.2_7

Sun SDK=1.3.1_13

Sun SDK=1.4.2_8

Sun SDK=1.4.2_11

Sun SDK=1.3.1_09

Sun SDK=1.4.2_9

Sun SDK=1.3.1_04

Sun SDK=1.3.1_05

Sun SDK=1.4.2_3

Sun SDK=1.3.1_11

Sun JSSE=1.0.3

Sun JSSE=1.0.3_02

Sun JSSE=1.0.3_01

Sun JSSE=1.0.3_03

Remediation

Patch Available

http://secunia.com/advisories/22204

Event History

Oct 9, 2006

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

Description

Oct 10, 2006

Data Sourced

via NVD·04:06 AM

RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2006-5201?

CVE-2006-5201 has a CVSS score that indicates a moderate level of severity depending on the specific configuration and use case.

How do I fix CVE-2006-5201?

To fix CVE-2006-5201, ensure you upgrade to the latest versions of all affected software packages identified in the vulnerability report.

Which versions are affected by CVE-2006-5201?

CVE-2006-5201 affects multiple versions of Java JDK, JRE, NSS, JSSE, and other Sun Solaris packages.

What types of software are vulnerable in CVE-2006-5201?

CVE-2006-5201 affects various Sun Solaris software packages, including NSS, Java JDK/JRE, JSSE, and StarOffice.

Can CVE-2006-5201 be exploited remotely?

Yes, CVE-2006-5201 has the potential for remote exploitation, which can compromise the integrity of systems using vulnerable software.