CVE-2006-5179

Intoto iGateway VPN and iGateway SSL-VPN allow context-dependent attackers to cause a denial of service (CPU consumption) via parasitic public keys with large (1) "public exponent" or (2) "public modulus" values in X.509 certificates that require extra time to process when using RSA signature verification, a related issue to CVE-2006-2940.

CVSS v2.0 5.4 MEDIUM

5.4^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:H/Au:N/C:N/I:N/A:C

Exploitability : 4.9 / Impact : 6.9

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact COMPLETE

References

Link	Resource
http://secunia.com/advisories/22206	Vendor Advisory
http://www.uniras.gov.uk/niscc/docs/re-20060928-00661.pdf?lang=en	Vendor Advisory
http://www.vupen.com/english/advisories/2006/3859
http://secunia.com/advisories/22206	Vendor Advisory
http://www.uniras.gov.uk/niscc/docs/re-20060928-00661.pdf?lang=en	Vendor Advisory
http://www.vupen.com/english/advisories/2006/3859

Configurations

Configuration 1 (hide)

OR	cpe:2.3:h:intoto:igateway_ssl-vpn::::::::
	cpe:2.3:h:intoto:igateway_vpn::::::::

History

No history.

Information

Published : 2006-10-10 04:06

Updated : 2025-04-09 00:30

NVD link : CVE-2006-5179

Mitre link : CVE-2006-5179

CVE.ORG link : CVE-2006-5179

JSON object : View

Products Affected

intoto

igateway_vpn
igateway_ssl-vpn

CWE

NVD-CWE-Other

{"id": "CVE-2006-5179", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.4, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:N/C:N/I:N/A:C", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "HIGH", "availabilityImpact": "COMPLETE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 6.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 4.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2006-10-10T04:06:00.000", "references": [{"url": "http://secunia.com/advisories/22206", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.uniras.gov.uk/niscc/docs/re-20060928-00661.pdf?lang=en", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2006/3859", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/22206", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.uniras.gov.uk/niscc/docs/re-20060928-00661.pdf?lang=en", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.vupen.com/english/advisories/2006/3859", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Intoto iGateway VPN and iGateway SSL-VPN allow context-dependent attackers to cause a denial of service (CPU consumption) via parasitic public keys with large (1) \"public exponent\" or (2) \"public modulus\" values in X.509 certificates that require extra time to process when using RSA signature verification, a related issue to CVE-2006-2940."}, {"lang": "es", "value": "Intoto iGateway VPN y iGateway SSL-VPN permite a un atacante dependiente del contexto provocar denegaci\u00f3n de servicio (consumo de CPU) a trav\u00e9s de llav\u00e9s p\u00fablicas par\u00e1sitas con un gran \"expoenente p\u00fablico\" o (2) valores \"m\u00f3dulo p\u00fablico\" en certificados X.509 que requieren tiempo extra para proceder con la verificaci\u00f3n de la firma de RSA, un tema relacionado con CVE-2006-2940."}], "lastModified": "2025-04-09T00:30:58.490", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:intoto:igateway_ssl-vpn:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AB142A4C-E7B6-43D8-A376-32C6A77FB7BF"}, {"criteria": "cpe:2.3:h:intoto:igateway_vpn:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DB91D1AA-041F-4BF2-B9FE-EFF3BC0E5266"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org", "evaluatorSolution": "It is reported that a patch may be obtained by contacting Intoto at the following email address: support@intoto.com"}