CVE-2016-2109

Severity

78%

Complexity

99%

Confidentiality

115%

The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in the ASN.1 BIO implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (memory consumption) via a short invalid encoding.

The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in the ASN.1 BIO implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (memory consumption) via a short invalid encoding.

CVSS 3.0 Base Score 7.5. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

CVSS 2.0 Base Score 7.8. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:C).

Overview

First reported 8 years ago

2016-05-05 01:59:00

Last updated 6 years ago

2018-07-19 01:29:00

Affected Software

OpenSSL Project OpenSSL

OpenSSL Project OpenSSL 1.0.2

1.0.2

OpenSSL Project OpenSSL 1.0.2-beta1

1.0.2

OpenSSL 1.0.2 Beta 2

1.0.2

OpenSSL 1.0.2 Beta 3

1.0.2

OpenSSL OpenSSL 1.0.2a

1.0.2a

OpenSSL Project OpenSSL 1.0.2b

1.0.2b

OpenSSL Project OpenSSL 1.0.2c

1.0.2c

OpenSSL OpenSSL 1.0.2d

1.0.2d

OpenSSL 1.0.2e

1.0.2e

OpenSSL 1.0.2f

1.0.2f

OpenSSL Project 1.0.2g

1.0.2g

RedHat Enterprise Linux Desktop 7.0

7.0

RedHat Enterprise Linux HPC Node 7.0

7.0

Red Hat Enterprise Linux HPC Node EUS 7.2

7.2

RedHat Enterprise Linux Server 7.0

7.0

Red Hat Enterprise Linux Server AUS 7.2

7.2

Red Hat Enterprise Linux Server EUS 7.2

7.2

RedHat Enterprise Linux Workstation 7.0

7.0

Red Hat Enterprise Linux Desktop 6.0

6.0

RedHat Enterprise Linux HPC Node 6.0

6.0

Red Hat Enterprise Linux Server 6.0

6.0

Red Hat Enterprise Linux Workstation 6.0

6.0

References

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759

APPLE-SA-2016-07-18-1

SUSE-SU-2016:1206

SUSE-SU-2016:1228

SUSE-SU-2016:1231

SUSE-SU-2016:1233

openSUSE-SU-2016:1237

openSUSE-SU-2016:1238

openSUSE-SU-2016:1239

openSUSE-SU-2016:1240

openSUSE-SU-2016:1241

openSUSE-SU-2016:1242

openSUSE-SU-2016:1243

SUSE-SU-2016:1267

openSUSE-SU-2016:1273

SUSE-SU-2016:1290

SUSE-SU-2016:1360

http://packetstormsecurity.com/files/136912/Slackware-Security-Advisory-openssl-Updates.html

RHSA-2016:0722

RHSA-2016:0996

RHSA-2016:2056

RHSA-2016:2073

RHSA-2016:2957

20160504 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: May 2016

DSA-3566

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html

http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html

http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html

87940

91787

1035721

SSA:2016-124-01

USN-2959-1

https://bto.bluecoat.com/security-advisory/sa123

https://git.openssl.org/?p=openssl.git;a=commit;h=c62981390d6cf9e3d612c489b8b77c2913b25807

https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03756en_us

https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03765en_us

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40202

https://kc.mcafee.com/corporate/index?page=content&id=SB10160

GLSA-201612-16

https://security.netapp.com/advisory/ntap-20160504-0001/

https://source.android.com/security/bulletin/2017-07-01

https://support.apple.com/HT206903

FreeBSD-SA-16:17

https://www.openssl.org/news/secadv/20160503.txt

Vendor Advisory

https://www.tenable.com/security/tns-2016-18

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.