PT-2016-3311 · Openssl+4 · Openssl+4
Guido Vranken
·
Publicado
2016-05-03
·
Atualizado
2024-06-15
·
CVE-2016-2176
CVSS v2.0
8.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
OpenSSL versions prior to 1.0.1t
OpenSSL versions prior to 1.0.2h
Description
The issue allows remote attackers to obtain sensitive information from process stack memory or cause a denial of service due to a buffer over-read. This can be achieved via crafted EBCDIC ASN.1 data. The vulnerability is related to the X509 NAME oneline function in the crypto/x509/x509 obj.c file. An unauthenticated, remote attacker could gain access to sensitive information on a targeted system.
Recommendations
For versions prior to 1.0.1t, update to version 1.0.1t or later.
For versions prior to 1.0.2h, update to version 1.0.2h or later.
As a temporary workaround, consider restricting access to the
X509 NAME oneline function until a patch is available.Exploit
Correção
DoS
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Freebsd
Huawei Vrp
Ibm Aix
Openssl