PT-2016-3417 · Openssl+11 · Openssl+14
Publicado
2016-09-16
·
Atualizado
2024-06-15
·
CVE-2016-2179
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
OpenSSL versions prior to 1.1.0
Description
The issue is related to the DTLS implementation in OpenSSL, which does not properly restrict the lifetime of queue entries associated with unused out-of-order messages. This allows remote attackers to cause a denial of service by maintaining many crafted DTLS sessions simultaneously. The problem is associated with errors in resource management.
Recommendations
For versions prior to 1.1.0, update to version 1.1.0 or later to resolve the issue. As a temporary workaround, consider restricting the number of simultaneous DTLS sessions to minimize the risk of exploitation.
Correção
DoS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Cisco Asa
Cisco Ios Xe
Cisco Nexus
Cisco Wls
Fortios
Freebsd
Huawei Vrp
Ibm Aix
Nessus
Openssl
Red Hat
Suse
Ubuntu