PT-2006-1074 · Gnu+1 · Gnutls+1

Daniel Bleichenbacher · Published 2006-09-14 · Updated 2025-12-03 · CVE-2006-4790

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: GnuTLS versions prior to 1.4.4

Description: The issue concerns a problem with handling excess data in the digestAlgorithm.parameters field when generating a hash using an RSA key with exponent 3. This can be exploited remotely, allowing attackers to forge a PKCS #1 v1.5 signature that is signed by the RSA key. As a result, GnuTLS may fail to correctly verify X.509 and other certificates that use PKCS.

Recommendations: For versions prior to 1.4.4, update to version 1.4.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of RSA keys with exponent 3 until a patch is applied.

Fix

Related Identifiers

BDU:2015-09533

CVE-2006-4790

DSA-1182-1

OPENSUSE-SU-2024:10801-1

RHSA-2006:0680

RHSA-2006_0680

Affected Products

Gnutls

Red Hat

References · 47

• http://mandriva.com/security/advisories?name=MDKSA-2006:166 · Vendor Advisory
• http://gnu.org/software/gnutls/security.html · Patch
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-102970-1 · Vendor Advisory
• http://debian.org/security/2006/dsa-1182 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200609-15.xml · Vendor Advisory
• http://ubuntu.com/usn/usn-348-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-4790 · Security Note
• http://redhat.com/support/errata/RHSA-2006-0680.html · Vendor Advisory
• http://novell.com/linux/security/advisories/2006_23_sr.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09533 · Security Note
• http://novell.com/linux/security/advisories/2007_10_ibmjava.html · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-102648-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10801-1 · Vendor Advisory
• http://secunia.com/advisories/22226 · Note
• http://secunia.com/advisories/21973 · Note