CVE-2006-2940: openssl Resource Management Errors

Modified

AliasesDEBIAN-CVE-2006-2940

Published 28-09-2006Last modified 07-08-2024

Some data may be incomplete

2 references with an unsupported link type were hidden.

Vulnerability summary

CVE-2006-2940 is a high (CVSS 7.8) Resource Management Errors vulnerability in openssl. EPSS estimates a 5.10% chance of exploitation in the next 30 days, higher than 92.3% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 7.8, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

7.8/10

010

High · v2.0 (NVD)

EPSS score

5.10%

0%100%

Low · +0.09 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 8 · Related 2

DSA-1185-2 DSA-1195-1 OPENSUSE-SU-2024:11126-1 OPENSUSE-SU-2024:11127-1 RHSA-2006:0695 RHSA-2008:0264+2 more

Timeline

28-09-2006
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions allows attackers to cause a denial of service (CPU consumption) via parasitic public keys with large (1) "public exponent" or (2) "public modulus" values in X.509 certificates that require extra time to process when using RSA signature verification.

CVSS metrics

1 score · 1 source · 1 version

v2.07.8

EPSS trend

Probability

5.10%

Chance of exploitation in the next 30 days

Percentile

92%

Versus all other CVEs

30-day change

Increase +0.09 pp

From 5.00% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-399Resource Management ErrorsWeaknesses in this category are related to improper management of system resources.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Debian1 product

openssl< 0.9.8c-2

Openssl1 product

opensslEOL0.9.1c | 0.9.2b | 0.9.3 | 0.9.3a | 0.9.4 | 0.9.5 | 0.9.5:beta1 | 0.9.5:beta2 | 0.9.5a | 0.9.5a:beta1 | 0.9.5a:beta2 | 0.9.6 | 0.9.6:beta1 | 0.9.6:beta2 | 0.9.6:beta3 | 0.9.6a | 0.9.6a:beta1 | 0.9.6a:beta2 | 0.9.6a:beta3 | 0.9.6b | 0.9.6c | 0.9.6d | 0.9.6e | 0.9.6f | 0.9.6g | 0.9.6h | 0.9.6i | 0.9.6j | 0.9.6k | 0.9.6l | 0.9.6m | 0.9.7 | 0.9.7a | 0.9.7b | 0.9.7c | 0.9.7d | 0.9.7e | 0.9.7f | 0.9.7g | 0.9.7h | 0.9.7i | 0.9.7j | 0.9.7k | 0.9.8 | 0.9.8a | 0.9.8b | 0.9.8c

2 vendors · 2 products

References

141 links

www.mandriva.com/security/advisories?name=MDKSA-2006:172Vendor AdvisoryX Refsource MANDRIVA
secunia.com/advisories/22212Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.ubuntu.com/usn/usn-353-2Vendor AdvisoryX Refsource UBUNTU
support.attachmate.com/techdocs/2374.htmlX Refsource CONFIRM
www.vupen.com/english/advisories/2006/4750VDB EntryX Refsource VUPEN
www.vmware.com/support/esx21/doc/esx-213-200612-patch.htmlX Refsource CONFIRM
www.uniras.gov.uk/niscc/docs/re-20060928-00661.pdf?lang=enX Refsource MISC
secunia.com/advisories/23915Third Party AdvisoryX Refsource SECUNIA
sunsolve.sun.com/search/document.do?assetkey=1-66-201534-1Vendor AdvisoryX Refsource SUNALERT
h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01118771Vendor AdvisoryX Refsource HP

Show all 100 references

securitytracker.com/id?1016943VDB EntryX Refsource SECTRACK
secunia.com/advisories/23038Third Party AdvisoryX Refsource SECUNIA
www.trustix.org/errata/2006/0054Vendor AdvisoryX Refsource TRUSTIX
www.debian.org/security/2006/dsa-1195Vendor AdvisoryX Refsource DEBIAN
secunia.com/advisories/23309Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/26893Third Party AdvisoryX Refsource SECUNIA
www.vmware.com/support/vi3/doc/esx-3069097-patch.htmlX Refsource CONFIRM
www.vupen.com/english/advisories/2006/4401VDB EntryX Refsource VUPEN
www.ubuntu.com/usn/usn-353-1Vendor AdvisoryX Refsource UBUNTU
sourceforge.net/project/shownotes.php?release_id=461863&group_id=69227X Refsource CONFIRM
secunia.com/advisories/22116Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www2.itrc.hp.com/service/cki/docDisplay.do?docId=c00967144Vendor AdvisoryX Refsource HP
support.avaya.com/elmodocs2/security/ASA-2006-260.htmX Refsource CONFIRM
www.gentoo.org/security/en/glsa/glsa-200612-11.xmlVendor AdvisoryX Refsource GENTOO
secunia.com/advisories/22166Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.redhat.com/support/errata/RHSA-2006-0695.htmlVendor AdvisoryX Refsource REDHAT
secunia.com/advisories/23340Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/22385Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.novell.com/linux/security/advisories/2006_24_sr.htmlVendor AdvisoryX Refsource SUSE
secunia.com/advisories/22758Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/22487Third Party AdvisoryX Refsource SECUNIA
www.novell.com/linux/security/advisories/2006_58_openssl.htmlVendor AdvisoryX Refsource SUSE
secunia.com/advisories/22772Third Party AdvisoryX Refsource SECUNIA
itrc.hp.com/service/cki/docDisplay.do?docId=c00849540Vendor AdvisoryX Refsource HP
secunia.com/advisories/31531Third Party AdvisoryX Refsource SECUNIA
www.arkoon.fr/upload/alertes/37AK-2006-06-FR-1.1_FAST360_OPENSSL_ASN1.pdfX Refsource CONFIRM
security.freebsd.org/advisories/FreeBSD-SA-06:23.openssl.ascVendor AdvisoryX Refsource FREEBSD
secunia.com/advisories/22165Third Party AdvisoryX Refsource SECUNIAVendor Advisory
docs.info.apple.com/article.html?artnum=304829X Refsource CONFIRM
lists.grok.org.uk/pipermail/full-disclosure/2006-September/049715.htmlMailing ListX Refsource FULLDISC
secunia.com/advisories/23794Third Party AdvisoryX Refsource SECUNIA
marc.info?l=bugtraq&m=130497311408250&w=2Vendor AdvisoryX Refsource HP
secunia.com/advisories/22220Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/23680Third Party AdvisoryX Refsource SECUNIA
openvpn.net/changelog.htmlX Refsource CONFIRM
www.vmware.com/support/server/doc/releasenotes_server.htmlX Refsource CONFIRM
issues.rpath.com/browse/RPL-1633X Refsource CONFIRM
secunia.com/advisories/25889Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2006/4036VDB EntryX Refsource VUPEN
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10311VDB EntrySignatureX Refsource OVAL
www.vupen.com/english/advisories/2006/4019VDB EntryX Refsource VUPEN
openbsd.org/errata.htmlVendor AdvisoryX Refsource OPENBSD
www.vmware.com/support/ace2/doc/releasenotes_ace2.htmlX Refsource CONFIRM
secunia.com/advisories/30124Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/22626Third Party AdvisoryX Refsource SECUNIA
exchange.xforce.ibmcloud.com/vulnerabilities/29230VDB EntryX Refsource XF
www.securityfocus.com/bid/22083VDB EntryX Refsource BID
www.mandriva.com/security/advisories?name=MDKSA-2006:178Vendor AdvisoryX Refsource MANDRIVA
secunia.com/advisories/23351Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2006/3869VDB EntryX Refsource VUPEN
secunia.com/advisories/22671Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/22544Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/22298Third Party AdvisoryX Refsource SECUNIA
www.vmware.com/support/player2/doc/releasenotes_player2.htmlX Refsource CONFIRM
secunia.com/advisories/22130Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/31492Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2006/4329VDB EntryX Refsource VUPEN
secunia.com/advisories/22284Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/24930Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2006/4327VDB EntryX Refsource VUPEN
www.redhat.com/support/errata/RHSA-2008-0629.htmlVendor AdvisoryX Refsource REDHAT
security.gentoo.org/glsa/glsa-200610-11.xmlVendor AdvisoryX Refsource GENTOO
issues.rpath.com/browse/RPL-613X Refsource CONFIRM
secunia.com/advisories/26329Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/22260Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.xerox.com/downloads/usa/en/c/cert_ESSNetwork_XRX07001_v1.pdfX Refsource CONFIRM
www.vupen.com/english/advisories/2007/0343VDB EntryX Refsource VUPEN
www.vupen.com/english/advisories/2006/3860VDB EntryX Refsource VUPEN
secunia.com/advisories/23280Third Party AdvisoryX Refsource SECUNIA
www.securityfocus.com/archive/1/447318/100/0/threadedMailing ListX Refsource BUGTRAQ
www.vmware.com/support/player/doc/releasenotes_player.htmlX Refsource CONFIRM
support.avaya.com/elmodocs2/security/ASA-2006-220.htmX Refsource CONFIRM
www.vupen.com/english/advisories/2006/4264VDB EntryX Refsource VUPEN
www.vmware.com/support/ws6/doc/releasenotes_ws6.htmlX Refsource CONFIRM
secunia.com/advisories/22193Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.vmware.com/support/esx2/doc/esx-202-200612-patch.htmlX Refsource CONFIRM
www.vupen.com/english/advisories/2008/2396VDB EntryX Refsource VUPEN
secunia.com/advisories/23155Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/22799Third Party AdvisoryX Refsource SECUNIA
sunsolve.sun.com/search/document.do?assetkey=1-66-200585-1Vendor AdvisoryX Refsource SUNALERT
slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.676946Vendor AdvisoryX Refsource SLACKWARE
www.vupen.com/english/advisories/2006/4417VDB EntryX Refsource VUPEN
www.serv-u.com/releasenotes/X Refsource CONFIRM
www.oracle.com/technetwork/topics/security/cpujan2007-101493.htmlX Refsource CONFIRM
www.vmware.com/support/esx25/doc/esx-254-200612-patch.htmlX Refsource CONFIRM
marc.info?l=bind-announce&m=116253119512445&w=2Mailing ListX Refsource MLIST
secunia.com/advisories/22094Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/22186Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.openssl.org/news/secadv_20060928.txtX Refsource CONFIRM
kolab.org/security/kolab-vendor-notice-11.txtX Refsource CONFIRM

Showing 100 of 141.