NVD脆弱性詳細

CVE-2006-2937

概要	OpenSSL 0.9.7 before 0.9.7l and 0.9.8 before 0.9.8d allows remote attackers to cause a denial of service (infinite loop and memory consumption) via malformed ASN.1 structures that trigger an improperly handled error condition.
公表日	2006年9月29日3:07
登録日	2021年1月29日15:39
最終更新日	2018年10月19日1:43

CVSS2.0 : HIGH
スコア	7.8
ベクター	AV:N/AC:L/Au:N/C:N/I:N/A:C
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃前の認証要否(Au)	不要
機密性への影響(C)	なし
完全性への影響(I)	なし
可用性への影響(A)	高
全ての特権を取得	いいえ
ユーザー権限を取得	いいえ
その他の権限を取得	いいえ
ユーザー操作が必要	いいえ

影響を受けるソフトウェアの構成

構成1	以上	以下	より上	未満
cpe:2.3:a:openssl:openssl:0.9.7:::::::*
cpe:2.3:a:openssl:openssl:0.9.7a:::::::*
cpe:2.3:a:openssl:openssl:0.9.7b:::::::*
cpe:2.3:a:openssl:openssl:0.9.7c:::::::*
cpe:2.3:a:openssl:openssl:0.9.7d:::::::*
cpe:2.3:a:openssl:openssl:0.9.7e:::::::*
cpe:2.3:a:openssl:openssl:0.9.7f:::::::*
cpe:2.3:a:openssl:openssl:0.9.7g:::::::*
cpe:2.3:a:openssl:openssl:0.9.7h:::::::*
cpe:2.3:a:openssl:openssl:0.9.7i:::::::*
cpe:2.3:a:openssl:openssl:0.9.7j:::::::*
cpe:2.3:a:openssl:openssl:0.9.7k:::::::*
cpe:2.3:a:openssl:openssl:0.9.8:::::::*
cpe:2.3:a:openssl:openssl:0.9.8a:::::::*
cpe:2.3:a:openssl:openssl:0.9.8b:::::::*
cpe:2.3:a:openssl:openssl:0.9.8c:::::::*

関連情報、対策とツール

No	URL	refsource	タグ
1	ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-007.txt.asc	NETBSD
2	ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc	SGI
3	http://docs.info.apple.com/article.html?artnum=304829	CONFIRM
4	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01118771	HP
5	http://issues.rpath.com/browse/RPL-613	CONFIRM
6	http://itrc.hp.com/service/cki/docDisplay.do?docId=c00805100	HP
7	http://itrc.hp.com/service/cki/docDisplay.do?docId=c00849540	HP
8	http://kolab.org/security/kolab-vendor-notice-11.txt	CONFIRM	Patch
9	http://lists.apple.com/archives/security-announce/2006/Nov/msg00001.html	APPLE
10	http://lists.grok.org.uk/pipermail/full-disclosure/2006-September/049715.html	FULLDISC	Patch
11	http://lists.vmware.com/pipermail/security-announce/2008/000008.html	MLIST
12	http://marc.info/?l=bind-announce&m=116253119512445&w=2	MLIST
13	http://marc.info/?l=bugtraq&m=130497311408250&w=2	HP
14	http://openbsd.org/errata.html#openssl2	OPENBSD	Patch
15	http://openvpn.net/changelog.html	CONFIRM	Patch
16	http://secunia.com/advisories/22094	SECUNIA	Patch Vendor Advisory
17	http://secunia.com/advisories/22116	SECUNIA	Patch Vendor Advisory
18	http://secunia.com/advisories/22130	SECUNIA	Patch Vendor Advisory
19	http://secunia.com/advisories/22165	SECUNIA	Patch Vendor Advisory
20	http://secunia.com/advisories/22166	SECUNIA	Patch Vendor Advisory
21	http://secunia.com/advisories/22172	SECUNIA	Patch Vendor Advisory
22	http://secunia.com/advisories/22186	SECUNIA	Patch Vendor Advisory
23	http://secunia.com/advisories/22193	SECUNIA	Patch Vendor Advisory
24	http://secunia.com/advisories/22207	SECUNIA	Patch Vendor Advisory
25	http://secunia.com/advisories/22212	SECUNIA	Patch Vendor Advisory
26	http://secunia.com/advisories/22216	SECUNIA	Patch Vendor Advisory
27	http://secunia.com/advisories/22220	SECUNIA	Patch Vendor Advisory
28	http://secunia.com/advisories/22240	SECUNIA	Patch Vendor Advisory
29	http://secunia.com/advisories/22259	SECUNIA	Patch Vendor Advisory
30	http://secunia.com/advisories/22260	SECUNIA	Patch Vendor Advisory
31	http://secunia.com/advisories/22284	SECUNIA	Patch Vendor Advisory
32	http://secunia.com/advisories/22298	SECUNIA
33	http://secunia.com/advisories/22330	SECUNIA	Patch Vendor Advisory
34	http://secunia.com/advisories/22385	SECUNIA	Vendor Advisory
35	http://secunia.com/advisories/22460	SECUNIA	Vendor Advisory
36	http://secunia.com/advisories/22487	SECUNIA	Vendor Advisory
37	http://secunia.com/advisories/22544	SECUNIA	Vendor Advisory
38	http://secunia.com/advisories/22626	SECUNIA	Vendor Advisory
39	http://secunia.com/advisories/22671	SECUNIA	Vendor Advisory
40	http://secunia.com/advisories/22758	SECUNIA
41	http://secunia.com/advisories/22772	SECUNIA
42	http://secunia.com/advisories/22799	SECUNIA
43	http://secunia.com/advisories/23038	SECUNIA
44	http://secunia.com/advisories/23131	SECUNIA
45	http://secunia.com/advisories/23155	SECUNIA
46	http://secunia.com/advisories/23280	SECUNIA
47	http://secunia.com/advisories/23309	SECUNIA
48	http://secunia.com/advisories/23340	SECUNIA
49	http://secunia.com/advisories/23351	SECUNIA
50	http://secunia.com/advisories/23680	SECUNIA
51	http://secunia.com/advisories/23915	SECUNIA
52	http://secunia.com/advisories/24930	SECUNIA
53	http://secunia.com/advisories/24950	SECUNIA
54	http://secunia.com/advisories/25889	SECUNIA
55	http://secunia.com/advisories/26329	SECUNIA
56	http://secunia.com/advisories/30124	SECUNIA
57	http://secunia.com/advisories/31492	SECUNIA
58	http://secunia.com/advisories/31531	SECUNIA
59	http://security.freebsd.org/advisories/FreeBSD-SA-06:23.openssl.asc	FREEBSD	Patch Vendor Advisory
60	http://security.gentoo.org/glsa/glsa-200610-11.xml	GENTOO
61	http://securitytracker.com/id?1016943	SECTRACK	Patch
62	http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.676946	SLACKWARE	Patch
63	http://sourceforge.net/project/shownotes.php?release_id=461863&group_id=69227	CONFIRM
64	http://sunsolve.sun.com/search/document.do?assetkey=1-26-102668-1	SUNALERT	Patch
65	http://sunsolve.sun.com/search/document.do?assetkey=1-26-102747-1	SUNALERT
66	http://sunsolve.sun.com/search/document.do?assetkey=1-66-200585-1	SUNALERT
67	http://sunsolve.sun.com/search/document.do?assetkey=1-66-201534-1	SUNALERT
68	http://support.attachmate.com/techdocs/2374.html	CONFIRM
69	http://support.avaya.com/elmodocs2/security/ASA-2006-220.htm	CONFIRM	Patch
70	http://support.avaya.com/elmodocs2/security/ASA-2006-260.htm	CONFIRM
71	http://www.arkoon.fr/upload/alertes/37AK-2006-06-FR-1.1_FAST360_OPENSSL_ASN1.pdf	CONFIRM	Patch Vendor Advisory
72	http://www.arkoon.fr/upload/alertes/41AK-2006-08-FR-1.1_SSL360_OPENSSL_ASN1.pdf	CONFIRM
73	http://www.cisco.com/en/US/products/hw/contnetw/ps4162/tsd_products_security_response09186a008077af1b.html	CISCO
74	http://www.cisco.com/warp/public/707/cisco-sr-20061108-openssl.shtml	CISCO
75	http://www.debian.org/security/2006/dsa-1185	DEBIAN	Patch
76	http://www.f-secure.com/security/fsc-2006-6.shtml	CONFIRM
77	http://www.gentoo.org/security/en/glsa/glsa-200612-11.xml	GENTOO
78	http://www.kb.cert.org/vuls/id/247744	CERT-VN	Patch US Government Resource
79	http://www.mandriva.com/security/advisories?name=MDKSA-2006:172	MANDRIVA
80	http://www.mandriva.com/security/advisories?name=MDKSA-2006:177	MANDRIVA
81	http://www.mandriva.com/security/advisories?name=MDKSA-2006:178	MANDRIVA
82	http://www.novell.com/linux/security/advisories/2006_24_sr.html	SUSE	Patch Vendor Advisory
83	http://www.novell.com/linux/security/advisories/2006_58_openssl.html	SUSE	Patch Vendor Advisory
84	http://www.openpkg.org/security/advisories/OpenPKG-SA-2006.021-openssl.html	OPENPKG	Patch Vendor Advisory
85	http://www.openssl.org/news/secadv_20060928.txt	CONFIRM	Patch Vendor Advisory
86	http://www.osvdb.org/29260	OSVDB
87	http://www.redhat.com/support/errata/RHSA-2006-0695.html	REDHAT	Patch
88	http://www.redhat.com/support/errata/RHSA-2008-0629.html	REDHAT
89	http://www.securityfocus.com/archive/1/447318/100/0/threaded	BUGTRAQ
90	http://www.securityfocus.com/archive/1/447393/100/0/threaded	BUGTRAQ
91	http://www.securityfocus.com/archive/1/456546/100/200/threaded	BUGTRAQ
92	http://www.securityfocus.com/archive/1/489739/100/0/threaded	BUGTRAQ
93	http://www.securityfocus.com/bid/20248	BID	Patch
94	http://www.securityfocus.com/bid/28276	BID
95	http://www.serv-u.com/releasenotes/	CONFIRM	Patch
96	http://www.trustix.org/errata/2006/0054	TRUSTIX	Patch
97	http://www.ubuntu.com/usn/usn-353-1	UBUNTU	Patch Vendor Advisory
98	http://www.us-cert.gov/cas/techalerts/TA06-333A.html	CERT	US Government Resource
99	http://www.vmware.com/security/advisories/VMSA-2008-0005.html	CONFIRM
100	http://www.vmware.com/support/ace2/doc/releasenotes_ace2.html	CONFIRM
101	http://www.vmware.com/support/esx2/doc/esx-202-200612-patch.html	CONFIRM
102	http://www.vmware.com/support/esx21/doc/esx-213-200612-patch.html	CONFIRM
103	http://www.vmware.com/support/esx25/doc/esx-253-200612-patch.html	CONFIRM
104	http://www.vmware.com/support/esx25/doc/esx-254-200612-patch.html	CONFIRM
105	http://www.vmware.com/support/player/doc/releasenotes_player.html	CONFIRM
106	http://www.vmware.com/support/player2/doc/releasenotes_player2.html	CONFIRM
107	http://www.vmware.com/support/server/doc/releasenotes_server.html	CONFIRM
108	http://www.vmware.com/support/vi3/doc/esx-3069097-patch.html	CONFIRM
109	http://www.vmware.com/support/vi3/doc/esx-9986131-patch.html	CONFIRM
110	http://www.vmware.com/support/ws55/doc/releasenotes_ws55.html	CONFIRM
111	http://www.vmware.com/support/ws6/doc/releasenotes_ws6.html	CONFIRM
112	http://www.vupen.com/english/advisories/2006/3820	VUPEN
113	http://www.vupen.com/english/advisories/2006/3860	VUPEN
114	http://www.vupen.com/english/advisories/2006/3869	VUPEN
115	http://www.vupen.com/english/advisories/2006/3902	VUPEN
116	http://www.vupen.com/english/advisories/2006/3936	VUPEN
117	http://www.vupen.com/english/advisories/2006/4019	VUPEN
118	http://www.vupen.com/english/advisories/2006/4036	VUPEN
119	http://www.vupen.com/english/advisories/2006/4264	VUPEN
120	http://www.vupen.com/english/advisories/2006/4327	VUPEN
121	http://www.vupen.com/english/advisories/2006/4329	VUPEN
122	http://www.vupen.com/english/advisories/2006/4401	VUPEN
123	http://www.vupen.com/english/advisories/2006/4417	VUPEN
124	http://www.vupen.com/english/advisories/2006/4750	VUPEN
125	http://www.vupen.com/english/advisories/2006/4761	VUPEN
126	http://www.vupen.com/english/advisories/2006/4980	VUPEN
127	http://www.vupen.com/english/advisories/2007/0343	VUPEN
128	http://www.vupen.com/english/advisories/2007/1401	VUPEN
129	http://www.vupen.com/english/advisories/2007/2315	VUPEN
130	http://www.vupen.com/english/advisories/2007/2783	VUPEN
131	http://www.vupen.com/english/advisories/2008/0905/references	VUPEN
132	http://www.vupen.com/english/advisories/2008/2396	VUPEN
133	http://www.xerox.com/downloads/usa/en/c/cert_ESSNetwork_XRX07001_v1.pdf	CONFIRM
134	https://exchange.xforce.ibmcloud.com/vulnerabilities/29228	XF
135	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10560	OVAL
136	https://www2.itrc.hp.com/service/cki/docDisplay.do?docId=c00967144	HP

共通脆弱性一覧

No	CWE	名前	URL
1	CWE-399	リソース管理の問題	https://cwe.mitre.org/data/definitions/399.html

構成1	以上	以下	より上	未満
cpe:2.3:a:openssl:openssl:0.9.7:::::::*
cpe:2.3:a:openssl:openssl:0.9.7a:::::::*
cpe:2.3:a:openssl:openssl:0.9.7b:::::::*
cpe:2.3:a:openssl:openssl:0.9.7c:::::::*
cpe:2.3:a:openssl:openssl:0.9.7d:::::::*
cpe:2.3:a:openssl:openssl:0.9.7e:::::::*
cpe:2.3:a:openssl:openssl:0.9.7f:::::::*
cpe:2.3:a:openssl:openssl:0.9.7g:::::::*
cpe:2.3:a:openssl:openssl:0.9.7h:::::::*
cpe:2.3:a:openssl:openssl:0.9.7i:::::::*
cpe:2.3:a:openssl:openssl:0.9.7j:::::::*
cpe:2.3:a:openssl:openssl:0.9.7k:::::::*
cpe:2.3:a:openssl:openssl:0.9.8:::::::*
cpe:2.3:a:openssl:openssl:0.9.8a:::::::*
cpe:2.3:a:openssl:openssl:0.9.8b:::::::*
cpe:2.3:a:openssl:openssl:0.9.8c:::::::*