Vulnerability in Sun Solaris
CVE-2006-7140
The libike library, as used by in.iked, elfsign, and kcfd in Sun Solaris 9 and 10, when using an RSA key with exponent 3, removes PKCS-1 padding before generating a hash, which allows remote attackers to forge a PKCS #1 v1.5 signature that is signed by that RSA key and prevents libike from correctly verifying X.509 and other certificates that use PKCS #1, a similar issue to CVE-2006-4339.
EPSS: 0.011 (63.4th percentile) — read the EPSS interpretation.
Affected products
- Sun Solaris — versions 10.0
- Sun Sunos — versions 5.9
- N/a — versions n/a
References
- cve@mitre.org (vendor-advisory, Patch, x_refsource_SUNALERT)
- cve@mitre.org (vdb-entry, x_refsource_VUPEN)
- cve@mitre.org (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- cve@mitre.org (x_refsource_OVAL, signature, vdb-entry)