Vulnerability Name: CVE-2006-5462 (CCN-30098) Assigned: 2006-11-08 Published: 2006-11-08 Updated: 2017-10-11 Summary: Mozilla Network Security Service (NSS) library before 3.11.3, as used in Mozilla Firefox before 1.5.0.8, Thunderbird before 1.5.0.8, and SeaMonkey before 1.0.6, when using an RSA key with exponent 3, does not properly handle extra data in a signature, which allows remote attackers to forge signatures for SSL/TLS and email certificates.Note : this identifier is for unpatched product versions that were originally intended to be addressed by CVE-2006-4340 . CVSS v3 Severity: 3.7 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N )Exploitability Metrics: Attack Vector (AV): NetworkAttack Complexity (AC): HighPrivileges Required (PR): NoneUser Interaction (UI): NoneScope: Scope (S): UnchangedImpact Metrics: Confidentiality (C): NoneIntegrity (I): LowAvailibility (A): None
CVSS v2 Severity: 6.4 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N )4.7 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N/E:U/RL:OF/RC:C )Exploitability Metrics: Access Vector (AV): NetworkAccess Complexity (AC): LowAuthentication (Au): NoneImpact Metrics: Confidentiality (C): PartialIntegrity (I): PartialAvailibility (A): None
2.6 Low (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N )1.9 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C )Exploitability Metrics: Access Vector (AV): NetworkAccess Complexity (AC): HighAthentication (Au): NoneImpact Metrics: Confidentiality (C): NoneIntegrity (I): PartialAvailibility (A): None
Vulnerability Type: CWE-Other Vulnerability Consequences: Bypass Security References: Source: SGI Type: UNKNOWN20061101-01-P Source: MITRE Type: CNACVE-2006-4340 Source: MITRE Type: CNACVE-2006-5462 Source: CCN Type: RHSA-2006-0675firefox security update Source: CCN Type: RHSA-2006-0676seamonkey security update Source: CCN Type: RHSA-2006-0677thunderbird security update Source: CCN Type: RHSA-2006-0733Critical: firefox security update Source: REDHAT Type: UNKNOWNRHSA-2006:0733 Source: CCN Type: RHSA-2006-0734Critical: seamonkey security update Source: REDHAT Type: UNKNOWNRHSA-2006:0734 Source: CCN Type: RHSA-2006-0735Critical: thunderbird security update Source: REDHAT Type: UNKNOWNRHSA-2006:0735 Source: CCN Type: SA21903Network Security Services (NSS) Signature Forgery Vulnerability Source: CCN Type: SA21906Mozilla Firefox Multiple Vulnerabilities Source: CCN Type: SA21939Mozilla Thunderbird Multiple Vulnerabilities Source: CCN Type: SA21940Mozilla SeaMonkey Multiple Vulnerabilities Source: SECUNIA Type: UNKNOWN22066 Source: CCN Type: SA22226Sun Solaris RSA Signature Forgery Vulnerability Source: CCN Type: SA22422Avaya Products Firefox Multiple Vulnerabilities Source: CCN Type: SA22722Mozilla Firefox and SeaMonkey Multiple Vulnerabilities Source: SECUNIA Type: Patch, Vendor Advisory22722 Source: SECUNIA Type: UNKNOWN22727 Source: SECUNIA Type: UNKNOWN22737 Source: SECUNIA Type: UNKNOWN22763 Source: CCN Type: SA22770Mozilla Thunderbird Multiple Vulnerabilities Source: SECUNIA Type: Patch, Vendor Advisory22770 Source: SECUNIA Type: UNKNOWN22815 Source: SECUNIA Type: UNKNOWN22817 Source: SECUNIA Type: UNKNOWN22929 Source: CCN Type: SA22965Avaya Messaging Storage Server Firefox Multiple Vulnerabilities Source: SECUNIA Type: UNKNOWN22965 Source: SECUNIA Type: UNKNOWN22980 Source: CCN Type: SA22992Avaya CMS Sun Solaris X Display Manager Security Issue Source: SECUNIA Type: UNKNOWN23009 Source: SECUNIA Type: UNKNOWN23013 Source: SECUNIA Type: UNKNOWN23197 Source: SECUNIA Type: UNKNOWN23202 Source: SECUNIA Type: UNKNOWN23235 Source: SECUNIA Type: UNKNOWN23263 Source: SECUNIA Type: UNKNOWN23287 Source: SECUNIA Type: UNKNOWN23297 Source: SECUNIA Type: UNKNOWN23883 Source: CCN Type: SA24711Netscape Multiple Vulnerabilities Source: SECUNIA Type: UNKNOWN24711 Source: GENTOO Type: UNKNOWNGLSA-200612-06 Source: GENTOO Type: UNKNOWNGLSA-200612-07 Source: GENTOO Type: UNKNOWNGLSA-200612-08 Source: CCN Type: SECTRACK ID: 1016858Mozilla Firefox Certificate Signatures Can Be Forged Source: CCN Type: SECTRACK ID: 1016859Mozilla Seamonkey Certificate Signatures Can Be Forged Source: CCN Type: SECTRACK ID: 1016860Mozilla Thunderbird Certificate Signatures Can Be Forged Source: CCN Type: SECTRACK ID: 1017180Mozilla Seamonkey RSA Signatures Can Be Forged Source: SECTRACK Type: UNKNOWN1017180 Source: CCN Type: SECTRACK ID: 1017181Mozilla Thunderbird RSA Signatures Can Be Forged Source: SECTRACK Type: UNKNOWN1017181 Source: CCN Type: SECTRACK ID: 1017182Mozilla Firefox RSA Signatures Can Be Forged Source: SECTRACK Type: UNKNOWN1017182 Source: CCN Type: Sun Alert ID: 102781RSA Signature Forgery Issues in Mozilla 1.7 for Solaris 8, 9 and 10 Source: SUNALERT Type: UNKNOWN102781 Source: CCN Type: ASA-2006-244thunderbird security update (RHSA-2006-0735) Source: CONFIRM Type: UNKNOWNhttp://support.avaya.com/elmodocs2/security/ASA-2006-246.htm Source: CCN Type: ASA-2006-246firefox security update (RHSA-2006-0733) Source: CCN Type: ASA-2006-247seamonkey security update (RHSA-2006-0734) Source: CCN Type: ASA-2007-044RSA Signature Forgery Issues in Mozilla 1.7 for Solaris 8 9 and 10 (Sun 102781) Source: CCN Type: ASA-2007-097HP-UX Running Firefox Remote Unauthorized Access or Elevation of Privileges or Denial of Service (DoS) (HPSBUX02153) Source: DEBIAN Type: UNKNOWNDSA-1224 Source: DEBIAN Type: UNKNOWNDSA-1225 Source: DEBIAN Type: UNKNOWNDSA-1227 Source: DEBIAN Type: DSA-1224mozilla -- several vulnerabilities Source: DEBIAN Type: DSA-1225mozilla-firefox -- several vulnerabilities Source: DEBIAN Type: DSA-1227mozilla-thunderbird -- several vulnerabilities Source: CCN Type: GLSA-200609-19Mozilla Firefox: Multiple vulnerabilities Source: CCN Type: GLSA-200610-01Mozilla Thunderbird: Multiple vulnerabilities Source: CCN Type: GLSA-200610-06Mozilla Network Security Service (NSS): RSA signature forgery Source: CCN Type: GLSA-200612-06Mozilla Thunderbird: Multiple vulnerabilities Source: CCN Type: GLSA-200612-07Mozilla Firefox: Multiple vulnerabilities Source: CCN Type: GLSA-200612-08SeaMonkey: Multiple vulnerabilities Source: CCN Type: US-CERT VU#335392The Mozilla Network Security Services library fails to properly verify RSA signatures Source: CERT-VN Type: Patch, US Government ResourceVU#335392 Source: MANDRIVA Type: UNKNOWNMDKSA-2006:205 Source: MANDRIVA Type: UNKNOWNMDKSA-2006:206 Source: MISC Type: Patchhttp://www.mozilla.org/security/announce/2006/mfsa2006-60.html Source: CCN Type: MFSA 2006-66RSA Signature Forgery (variant) Source: CONFIRM Type: Patchhttp://www.mozilla.org/security/announce/2006/mfsa2006-66.html Source: SUSE Type: UNKNOWNSUSE-SA:2006:068 Source: CCN Type: USN-350-1Thunderbird vulnerabilities Source: CCN Type: USN-351-1Firefox vulnerabilities Source: CCN Type: USN-352-1Thunderbird vulnerabilities Source: CCN Type: USN-354-1Firefox vulnerabilities Source: CCN Type: USN-361-1Mozilla vulnerabilities Source: CCN Type: USN-381-1Firefox vulnerabilities Source: UBUNTU Type: UNKNOWNUSN-381-1 Source: CCN Type: USN-382-1Thunderbird vulnerabilities Source: UBUNTU Type: UNKNOWNUSN-382-1 Source: CERT Type: Patch, US Government ResourceTA06-312A Source: VUPEN Type: UNKNOWNADV-2006-3748 Source: VUPEN Type: UNKNOWNADV-2006-4387 Source: VUPEN Type: UNKNOWNADV-2007-0293 Source: VUPEN Type: UNKNOWNADV-2007-1198 Source: VUPEN Type: UNKNOWNADV-2008-0083 Source: HP Type: UNKNOWNSSRT061181 Source: MISC Type: Patchhttps://bugzilla.mozilla.org/show_bug.cgi?id=356215 Source: XF Type: UNKNOWNmozilla-nss-security-bypass(30098) Source: XF Type: UNKNOWNmozilla-nss-security-bypass(30098) Source: OVAL Type: UNKNOWNoval:org.mitre.oval:def:10478 Source: SUSE Type: SUSE-SA:2006:054Mozilla Firefox security update Source: SUSE Type: SUSE-SA:2006:055PKCS RSA signature forgery Source: SUSE Type: SUSE-SA:2006:068Mozilla Firefox 1.5.0.8 release Vulnerable Configuration: Configuration 1 :cpe:/a:mozilla:firefox:1.5:*:*:*:*:*:*:* OR cpe:/a:mozilla:firefox:1.5:beta1:*:*:*:*:*:* OR cpe:/a:mozilla:firefox:1.5:beta2:*:*:*:*:*:* OR cpe:/a:mozilla:firefox:1.5.0.1:*:*:*:*:*:*:* OR cpe:/a:mozilla:firefox:1.5.0.2:*:*:*:*:*:*:* OR cpe:/a:mozilla:firefox:1.5.0.3:*:*:*:*:*:*:* OR cpe:/a:mozilla:firefox:1.5.0.4:*:*:*:*:*:*:* OR cpe:/a:mozilla:firefox:1.5.0.5:*:*:*:*:*:*:* OR cpe:/a:mozilla:firefox:1.5.0.6:*:*:*:*:*:*:* OR cpe:/a:mozilla:firefox:1.5.0.7:*:*:*:*:*:*:* OR cpe:/a:mozilla:network_security_services:3.11.3:*:*:*:*:*:*:* OR cpe:/a:mozilla:seamonkey:1.0:*:*:*:*:*:*:* OR cpe:/a:mozilla:seamonkey:1.0:*:alpha:*:*:*:*:* OR cpe:/a:mozilla:seamonkey:1.0:*:dev:*:*:*:*:* OR cpe:/a:mozilla:seamonkey:1.0:beta:*:*:*:*:*:* OR cpe:/a:mozilla:seamonkey:1.0.1:*:*:*:*:*:*:* OR cpe:/a:mozilla:seamonkey:1.0.2:*:*:*:*:*:*:* OR cpe:/a:mozilla:seamonkey:1.0.3:*:*:*:*:*:*:* OR cpe:/a:mozilla:seamonkey:1.0.4:*:*:*:*:*:*:* OR cpe:/a:mozilla:seamonkey:1.0.5:*:*:*:*:*:*:* OR cpe:/a:mozilla:thunderbird:1.5:-:*:*:*:*:*:* OR cpe:/a:mozilla:thunderbird:1.5:beta2:*:*:*:*:*:* OR cpe:/a:mozilla:thunderbird:1.5.0.1:*:*:*:*:*:*:* OR cpe:/a:mozilla:thunderbird:1.5.0.2:*:*:*:*:*:*:* OR cpe:/a:mozilla:thunderbird:1.5.0.3:*:*:*:*:*:*:* OR cpe:/a:mozilla:thunderbird:1.5.0.4:*:*:*:*:*:*:* OR cpe:/a:mozilla:thunderbird:1.5.0.6:*:*:*:*:*:*:* OR cpe:/a:mozilla:thunderbird:1.5.0.7:*:*:*:*:*:*:* Configuration RedHat 1 :cpe:/o:redhat:enterprise_linux:4:*:*:*:*:*:*:* Configuration RedHat 2 :cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:* Configuration RedHat 3 :cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:* Configuration RedHat 4 :cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:* Configuration RedHat 5 :cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:* Configuration CCN 1 :cpe:/a:mozilla:firefox:1.5:beta1:*:*:*:*:*:* OR cpe:/a:mozilla:seamonkey:1.0::dev:*:*:*:*:* OR cpe:/a:mozilla:firefox:1.5:*:*:*:*:*:*:* OR cpe:/a:mozilla:thunderbird:1.5:-:*:*:*:*:*:* OR cpe:/a:mozilla:thunderbird:1.5:beta2:*:*:*:*:*:* OR cpe:/a:mozilla:firefox:1.5.0.2:*:*:*:*:*:*:* OR cpe:/a:mozilla:firefox:1.5.0.3:*:*:*:*:*:*:* OR cpe:/a:mozilla:firefox:1.5.0.4:*:*:*:*:*:*:* OR cpe:/a:mozilla:firefox:1.5.0.6:*:*:*:*:*:*:* OR cpe:/a:mozilla:firefox:1.5.0.7:*:*:*:*:*:*:* OR cpe:/a:mozilla:thunderbird:1.5.0.7:*:*:*:*:*:*:* OR cpe:/a:mozilla:seamonkey:1.0.5:*:*:*:*:*:*:* OR cpe:/a:mozilla:network_security_services:3.11.3:*:*:*:*:*:*:* OR cpe:/a:mozilla:seamonkey:1.0.2:*:*:*:*:*:*:* OR cpe:/a:mozilla:thunderbird:1.5.0.6:*:*:*:*:*:*:* OR cpe:/a:mozilla:thunderbird:1.5.0.4:*:*:*:*:*:*:* OR cpe:/a:mozilla:thunderbird:1.5.0.3:*:*:*:*:*:*:* OR cpe:/a:mozilla:thunderbird:1.5.0.2:*:*:*:*:*:*:* OR cpe:/a:mozilla:thunderbird:1.5.0.1:*:*:*:*:*:*:* OR cpe:/a:mozilla:seamonkey:1.0:*:*:*:*:*:*:* OR cpe:/a:mozilla:seamonkey:1.0.1:*:*:*:*:*:*:* OR cpe:/a:mozilla:seamonkey:1.0.3:*:*:*:*:*:*:* OR cpe:/a:mozilla:seamonkey:1.0.4:*:*:*:*:*:*:* OR cpe:/a:mozilla:firefox:1.5.0.1:*:*:*:*:*:*:* OR cpe:/a:mozilla:firefox:1.5.0.5:*:*:*:*:*:*:* OR cpe:/a:mozilla:firefox:1.5:beta2:*:*:*:*:*:* OR cpe:/a:mozilla:network_security_services:3.11.2:*:*:*:*:*:*:* OR cpe:/a:mozilla:seamonkey:1.0::alpha:*:*:*:*:* OR cpe:/a:mozilla:seamonkey:1.0::beta:*:*:*:*:* AND cpe:/o:sun:solaris:8::x86:*:*:*:*:* OR cpe:/o:gentoo:linux:*:*:*:*:*:*:*:* OR cpe:/o:redhat:enterprise_linux:2.1:*:as:*:*:*:*:* OR cpe:/o:redhat:enterprise_linux:2.1:*:es:*:*:*:*:* OR cpe:/o:redhat:enterprise_linux:2.1:*:ws:*:*:*:*:* OR cpe:/o:redhat:enterprise_linux:3::ws:*:*:*:*:* OR cpe:/o:redhat:enterprise_linux:3::es:*:*:*:*:* OR cpe:/o:redhat:enterprise_linux:3::as:*:*:*:*:* OR cpe:/o:sun:solaris:8::sparc:*:*:*:*:* OR cpe:/o:sun:solaris:9::x86:*:*:*:*:* OR cpe:/o:redhat:enterprise_linux:3::desktop:*:*:*:*:* OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0:*:*:*:*:*:*:* OR cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:* OR cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:* OR cpe:/o:novell:linux_desktop:9:*:*:*:*:*:*:* OR cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:* OR cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:* OR cpe:/o:debian:debian_linux:3.1:*:*:*:*:*:*:* OR cpe:/a:novell:open_enterprise_server:*:*:*:*:*:*:*:* OR cpe:/o:sun:solaris:10::sparc:*:*:*:*:* OR cpe:/o:suse:suse_linux:10.0::oss:*:*:*:*:* OR cpe:/o:redhat:linux_advanced_workstation:2.1::itanium:*:*:*:*:* OR cpe:/o:mandrakesoft:mandrake_linux:2006:*:*:*:*:*:*:* OR cpe:/o:canonical:ubuntu:6.06::lts:*:*:*:*:* OR cpe:/o:suse:suse_linux:10.1::personal:*:*:*:*:* OR cpe:/o:mandrakesoft:mandrake_linux:2006::x86-64:*:*:*:*:* OR cpe:/o:mandrakesoft:mandrake_linux:2007:*:*:*:*:*:*:* OR cpe:/o:mandrakesoft:mandrake_linux:2007::x86_64:*:*:*:*:* OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:4.0:*:*:*:*:*:*:* OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:4.0::x86_64:*:*:*:*:* OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0::x86_64:*:*:*:*:* OR cpe:/a:novell:open_enterprise_server:*:*:*:*:*:*:*:* OR cpe:/o:sun:solaris:9::sparc:*:*:*:*:* Denotes that component is vulnerable Oval Definitions BACK
mozilla firefox 1.5
mozilla firefox 1.5 beta1
mozilla firefox 1.5 beta2
mozilla firefox 1.5.0.1
mozilla firefox 1.5.0.2
mozilla firefox 1.5.0.3
mozilla firefox 1.5.0.4
mozilla firefox 1.5.0.5
mozilla firefox 1.5.0.6
mozilla firefox 1.5.0.7
mozilla network security services 3.11.3
mozilla seamonkey 1.0
mozilla seamonkey 1.0
mozilla seamonkey 1.0
mozilla seamonkey 1.0 beta
mozilla seamonkey 1.0.1
mozilla seamonkey 1.0.2
mozilla seamonkey 1.0.3
mozilla seamonkey 1.0.4
mozilla seamonkey 1.0.5
mozilla thunderbird 1.5
mozilla thunderbird 1.5 beta2
mozilla thunderbird 1.5.0.1
mozilla thunderbird 1.5.0.2
mozilla thunderbird 1.5.0.3
mozilla thunderbird 1.5.0.4
mozilla thunderbird 1.5.0.6
mozilla thunderbird 1.5.0.7
mozilla firefox 1.5 beta1
mozilla seamonkey 1.0
mozilla firefox 1.5
mozilla thunderbird 1.5
mozilla thunderbird 1.5 beta2
mozilla firefox 1.5.0.2
mozilla firefox 1.5.0.3
mozilla firefox 1.5.0.4
mozilla firefox 1.5.0.6
mozilla firefox 1.5.0.7
mozilla thunderbird 1.5.0.7
mozilla seamonkey 1.0.5
mozilla network security services 3.11.3
mozilla seamonkey 1.0.2
mozilla thunderbird 1.5.0.6
mozilla thunderbird 1.5.0.4
mozilla thunderbird 1.5.0.3
mozilla thunderbird 1.5.0.2
mozilla thunderbird 1.5.0.1
mozilla seamonkey 1.0
mozilla seamonkey 1.0.1
mozilla seamonkey 1.0.3
mozilla seamonkey 1.0.4
mozilla firefox 1.5.0.1
mozilla firefox 1.5.0.5
mozilla firefox 1.5 beta2
mozilla network security services 3.11.2
mozilla seamonkey 1.0
mozilla seamonkey 1.0
sun solaris 8
gentoo linux *
redhat enterprise linux 2.1
redhat enterprise linux 2.1
redhat enterprise linux 2.1
redhat enterprise linux 3
redhat enterprise linux 3
redhat enterprise linux 3
sun solaris 8
sun solaris 9
redhat enterprise linux 3
mandrakesoft mandrake linux corporate server 3.0
redhat enterprise linux 4
redhat enterprise linux 4
novell linux desktop 9
redhat enterprise linux 4
redhat enterprise linux 4
debian debian linux 3.1
novell open enterprise server *
sun solaris 10
suse suse linux 10.0
redhat linux advanced workstation 2.1
mandrakesoft mandrake linux 2006
canonical ubuntu 6.06
suse suse linux 10.1
mandrakesoft mandrake linux 2006
mandrakesoft mandrake linux 2007
mandrakesoft mandrake linux 2007
mandrakesoft mandrake linux corporate server 4.0
mandrakesoft mandrake linux corporate server 4.0
mandrakesoft mandrake linux corporate server 3.0
novell open enterprise server *
sun solaris 9