PT-2016-3315 · Openssl+3 · Openssl+3
Robert Åšwiä™Cki
·
Publicado
2016-09-26
·
Atualizado
2018-07-12
·
CVE-2016-6309
CVSS v3.1
10
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
OpenSSL version 1.1.0a
Description
The issue is related to the use of memory after it has been freed in the statem/statem.c component of the OpenSSL library. This can be exploited by a remote attacker to gain unauthorized access to confidential data, cause a denial of service, or impact data integrity through a specially crafted TLS session. The problem arises because the statem/statem.c file in OpenSSL 1.1.0a does not account for memory block movement after a realloc call, allowing remote attackers to cause a denial of service or possibly execute arbitrary code.
Recommendations
For OpenSSL version 1.1.0a, consider updating to a newer version that addresses this issue, as using memory after it has been freed can lead to significant security risks. As a temporary workaround, consider restricting the use of TLS sessions to minimize the risk of exploitation.
Correção
DoS
Use After Free
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Huawei Vrp
Nessus
Openssl