PT-2016-1334 · Openssl+7 · Openssl+7
Emilia Kã¤Sper
·
Publicado
2016-03-01
·
Atualizado
2024-06-15
·
CVE-2016-0798
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
OpenSSL versions 1.0.1 through 1.0.1s
OpenSSL versions 1.0.2 through 1.0.2g
Description
The issue is related to errors in resource management in the SRP VBASE get by user function implementation in OpenSSL. It allows a remote attacker to cause a denial of service (memory consumption) by providing an invalid username in a connection attempt. This can lead to a memory leak, potentially causing the service to become unresponsive. Additionally, there is a mention of a side-channel attack that could lead to the recovery of RSA keys, but details are not provided.
Recommendations
For OpenSSL versions 1.0.1 through 1.0.1s, update to version 1.0.1s or later to resolve the issue.
For OpenSSL versions 1.0.2 through 1.0.2g, update to version 1.0.2g or later to resolve the issue.
As a temporary workaround, consider restricting access to the SRP VBASE get by user function to minimize the risk of exploitation.
Correção
DoS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Cisco Nexus
Freebsd
Ibm Aix
Junos
Openssl
Suse
Ubuntu