HOME VULNERABILITIESCVE-2006-5201

MEDIUM

CVE-2006-5201

NVD-CWE-OtherPublished: October 10, 2006· Updated: Jun 16, 2026

4.0

CVSS v3.1

Official Description

Multiple packages on Sun Solaris, including (1) NSS; (2) Java JDK and JRE 5.0 Update 8 and earlier, SDK and JRE 1.4.x up to 1.4.2_12, and SDK and JRE 1.3.x up to 1.3.1_19; (3) JSSE 1.0.3_03 and earlier; (4) IPSec/IKE; (5) Secure Global Desktop; and (6) StarOffice, when using an RSA key with exponent 3, removes PKCS-1 padding before generating a hash, which allows remote attackers to forge a PKCS #1 v1.5 signature that is signed by that RSA key and prevents these products from correctly verifying X.509 and other certificates that use PKCS #1.

Technical Analysis

CVE-2006-5201 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorNetwork

Attack ComplexityHigh

Privileges Req.

User Interaction

Scope

Impact

ConfidentialityNone

IntegrityP

AvailabilityP

AV:N/AC:H/Au:N/C:N/I:P/A:P

Affected Vendors & Products

sun9 product(s)

nsssecure global desktopstarofficesolarissunosjdkjresdkjsse

Source: NVD CPE · 78 total CPE entries

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time

Offensive Security exploit database

GitHub PoC Search

Community PoC repositories

Rapid7 / Metasploit

Metasploit module search

Security advisories & exploits

Official NIST entry

CVE Program entry

External links open in a new tab. Always verify in a controlled environment before use.

Official Patches & Advisories

PATCHhttp://secunia.com/advisories/22204

PATCHhttp://secunia.com/advisories/22204

ADVISORYhttp://secunia.com/advisories/22226

ADVISORYhttp://secunia.com/advisories/22325

ADVISORYhttp://secunia.com/advisories/22992

ADVISORYhttp://support.avaya.com/elmodocs2/security/ASA-2006-250.htm

ADVISORYhttp://www.kb.cert.org/vuls/id/845620

ADVISORYhttp://secunia.com/advisories/22226

ADVISORYhttp://secunia.com/advisories/22325

ADVISORYhttp://secunia.com/advisories/22992

ADVISORYhttp://support.avaya.com/elmodocs2/security/ASA-2006-250.htm

ADVISORYhttp://www.kb.cert.org/vuls/id/845620

All References (22)

→

http://secunia.com/advisories/22204Patch · Third Party Advisory

→

http://secunia.com/advisories/22226Third Party Advisory

→

http://secunia.com/advisories/22325Third Party Advisory

→

http://secunia.com/advisories/22992Third Party Advisory

→

http://sunsolve.sun.com/search/document.do?assetkey=1-26-102648-1Broken Link

→

http://sunsolve.sun.com/search/document.do?assetkey=1-26-102657-1Broken Link

→

http://support.avaya.com/elmodocs2/security/ASA-2006-250.htmThird Party Advisory

→

http://www.kb.cert.org/vuls/id/845620Third Party Advisory · US Government Resource

→

http://www.vupen.com/english/advisories/2006/3898Permissions Required

→

http://www.vupen.com/english/advisories/2006/3899Permissions Required

→

http://www.vupen.com/english/advisories/2006/3960Permissions Required

→

http://secunia.com/advisories/22204Patch · Third Party Advisory

→

http://secunia.com/advisories/22226Third Party Advisory

→

http://secunia.com/advisories/22325Third Party Advisory

→

http://secunia.com/advisories/22992Third Party Advisory

Quick Facts

CVE IDCVE-2006-5201

CVSS Score4.0 / 10

SeverityMEDIUM

WeaknessNVD-CWE-Other

CISA KEVNo

Affected1 vendor(s)

PublishedOct 10, 2006

Related CVEs (NVD-CWE-Other)

Recommended Actions

→Apply vendor patches immediately
→Monitor CVE-2006-5201 in threat intel feeds
→Review IDS/IPS signatures for exploitation attempts

Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWatch. CVE data is provided under the NVD usage policy.

← All Vulnerabilities·Search for CVE-2006-5201·NVD