1. CVE-Search
  2. CVE-2006-5462
ID CVE-2006-5462
Summary Mozilla Network Security Service (NSS) library before 3.11.3, as used in Mozilla Firefox before 1.5.0.8, Thunderbird before 1.5.0.8, and SeaMonkey before 1.0.6, when using an RSA key with exponent 3, does not properly handle extra data in a signature, which allows remote attackers to forge signatures for SSL/TLS and email certificates. NOTE: this identifier is for unpatched product versions that were originally intended to be addressed by CVE-2006-4340.
References
Vulnerable Configurations
  • cpe:2.3:a:mozilla:firefox:1.5:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.5:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.5:beta1:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.5:beta1:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.5:beta2:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.5:beta2:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.5.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.5.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.5.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.5.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.5.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.5.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.5.0.4:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.5.0.4:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.5.0.5:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.5.0.5:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.5.0.6:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.5.0.6:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.5.0.7:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.5.0.7:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:network_security_services:3.11.3:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:network_security_services:3.11.3:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:seamonkey:1.0:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:seamonkey:1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:seamonkey:1.0:*:alpha:*:*:*:*:*
    cpe:2.3:a:mozilla:seamonkey:1.0:*:alpha:*:*:*:*:*
  • cpe:2.3:a:mozilla:seamonkey:1.0:*:dev:*:*:*:*:*
    cpe:2.3:a:mozilla:seamonkey:1.0:*:dev:*:*:*:*:*
  • cpe:2.3:a:mozilla:seamonkey:1.0:beta:*:*:*:*:*:*
    cpe:2.3:a:mozilla:seamonkey:1.0:beta:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:seamonkey:1.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:seamonkey:1.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:seamonkey:1.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:seamonkey:1.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:seamonkey:1.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:seamonkey:1.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:seamonkey:1.0.4:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:seamonkey:1.0.4:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:seamonkey:1.0.5:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:seamonkey:1.0.5:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:thunderbird:1.5:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:thunderbird:1.5:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:thunderbird:1.5:beta2:*:*:*:*:*:*
    cpe:2.3:a:mozilla:thunderbird:1.5:beta2:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:thunderbird:1.5.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:thunderbird:1.5.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:thunderbird:1.5.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:thunderbird:1.5.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:thunderbird:1.5.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:thunderbird:1.5.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:thunderbird:1.5.0.4:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:thunderbird:1.5.0.4:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:thunderbird:1.5.0.6:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:thunderbird:1.5.0.6:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:thunderbird:1.5.0.7:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:thunderbird:1.5.0.7:*:*:*:*:*:*:*
CVSS
Base: 6.4 (as of 11-10-2017 - 01:31)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL NONE
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:P/A:N
oval via4
accepted 2013-04-29T04:06:00.283-04:00
class vulnerability
contributors
  • name Aharon Chernin
    organization SCAP.com, LLC
  • name Dragos Prisaca
    organization G2, Inc.
definition_extensions
  • comment The operating system installed on the system is Red Hat Enterprise Linux 3
    oval oval:org.mitre.oval:def:11782
  • comment CentOS Linux 3.x
    oval oval:org.mitre.oval:def:16651
  • comment The operating system installed on the system is Red Hat Enterprise Linux 4
    oval oval:org.mitre.oval:def:11831
  • comment CentOS Linux 4.x
    oval oval:org.mitre.oval:def:16636
  • comment Oracle Linux 4.x
    oval oval:org.mitre.oval:def:15990
description Mozilla Network Security Service (NSS) library before 3.11.3, as used in Mozilla Firefox before 1.5.0.8, Thunderbird before 1.5.0.8, and SeaMonkey before 1.0.6, when using an RSA key with exponent 3, does not properly handle extra data in a signature, which allows remote attackers to forge signatures for SSL/TLS and email certificates. NOTE: this identifier is for unpatched product versions that were originally intended to be addressed by CVE-2006-4340.
family unix
id oval:org.mitre.oval:def:10478
status accepted
submitted 2010-07-09T03:56:16-04:00
title Mozilla Network Security Service (NSS) library before 3.11.3, as used in Mozilla Firefox before 1.5.0.8, Thunderbird before 1.5.0.8, and SeaMonkey before 1.0.6, when using an RSA key with exponent 3, does not properly handle extra data in a signature, which allows remote attackers to forge signatures for SSL/TLS and email certificates. NOTE: this identifier is for unpatched product versions that were originally intended to be addressed by CVE-2006-4340.
version 29
redhat via4
advisories
  • rhsa
    id RHSA-2006:0733
  • rhsa
    id RHSA-2006:0734
  • rhsa
    id RHSA-2006:0735
rpms
  • firefox-0:1.5.0.8-0.1.el4
  • firefox-debuginfo-0:1.5.0.8-0.1.el4
  • devhelp-0:0.10-0.5.el4
  • devhelp-debuginfo-0:0.10-0.5.el4
  • devhelp-devel-0:0.10-0.5.el4
  • seamonkey-0:1.0.6-0.1.el2
  • seamonkey-0:1.0.6-0.1.el3
  • seamonkey-0:1.0.6-0.1.el4
  • seamonkey-chat-0:1.0.6-0.1.el2
  • seamonkey-chat-0:1.0.6-0.1.el3
  • seamonkey-chat-0:1.0.6-0.1.el4
  • seamonkey-debuginfo-0:1.0.6-0.1.el3
  • seamonkey-debuginfo-0:1.0.6-0.1.el4
  • seamonkey-devel-0:1.0.6-0.1.el2
  • seamonkey-devel-0:1.0.6-0.1.el3
  • seamonkey-devel-0:1.0.6-0.1.el4
  • seamonkey-dom-inspector-0:1.0.6-0.1.el2
  • seamonkey-dom-inspector-0:1.0.6-0.1.el3
  • seamonkey-dom-inspector-0:1.0.6-0.1.el4
  • seamonkey-js-debugger-0:1.0.6-0.1.el2
  • seamonkey-js-debugger-0:1.0.6-0.1.el3
  • seamonkey-js-debugger-0:1.0.6-0.1.el4
  • seamonkey-mail-0:1.0.6-0.1.el2
  • seamonkey-mail-0:1.0.6-0.1.el3
  • seamonkey-mail-0:1.0.6-0.1.el4
  • seamonkey-nspr-0:1.0.6-0.1.el2
  • seamonkey-nspr-0:1.0.6-0.1.el3
  • seamonkey-nspr-devel-0:1.0.6-0.1.el2
  • seamonkey-nspr-devel-0:1.0.6-0.1.el3
  • seamonkey-nss-0:1.0.6-0.1.el2
  • seamonkey-nss-0:1.0.6-0.1.el3
  • seamonkey-nss-devel-0:1.0.6-0.1.el2
  • seamonkey-nss-devel-0:1.0.6-0.1.el3
  • thunderbird-0:1.5.0.8-0.1.el4
  • thunderbird-debuginfo-0:1.5.0.8-0.1.el4
refmap via4
cert TA06-312A
cert-vn VU#335392
confirm
debian
  • DSA-1224
  • DSA-1225
  • DSA-1227
gentoo
  • GLSA-200612-06
  • GLSA-200612-07
  • GLSA-200612-08
hp
  • HPSBUX02153
  • SSRT061181
mandriva
  • MDKSA-2006:205
  • MDKSA-2006:206
misc
sectrack
  • 1017180
  • 1017181
  • 1017182
secunia
  • 22066
  • 22722
  • 22727
  • 22737
  • 22763
  • 22770
  • 22815
  • 22817
  • 22929
  • 22965
  • 22980
  • 23009
  • 23013
  • 23197
  • 23202
  • 23235
  • 23263
  • 23287
  • 23297
  • 23883
  • 24711
sgi 20061101-01-P
sunalert 102781
suse SUSE-SA:2006:068
ubuntu
  • USN-381-1
  • USN-382-1
vupen
  • ADV-2006-3748
  • ADV-2006-4387
  • ADV-2007-0293
  • ADV-2007-1198
  • ADV-2008-0083
xf mozilla-nss-security-bypass(30098)
Last major update 11-10-2017 - 01:31
Published 08-11-2006 - 21:07
Last modified 11-10-2017 - 01:31
Back to Top