PT-2016-7520 · Oracle+10 · Oracle Peoplesoft Enterprise Peopletools+44

Publicado 2016-10-24 · Atualizado 2025-09-29 · CVE-2016-8610

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenSSL versions 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 debian linux (affected versions not specified) fujitsu m10-1 firmware (affected versions not specified) fujitsu m10-4 firmware (affected versions not specified) fujitsu m10-4s firmware (affected versions not specified) fujitsu m12-1 firmware (affected versions not specified) fujitsu m12-2 firmware (affected versions not specified) fujitsu m12-2s firmware (affected versions not specified) netapp clustered data ontap (affected versions not specified) netapp clustered data ontap antivirus connector (affected versions not specified) netapp cn1610 firmware (affected versions not specified) netapp data ontap (affected versions not specified) netapp data ontap edge (affected versions not specified) netapp e-series santricity os controller (affected versions not specified) netapp host agent (affected versions not specified) netapp oncommand balance (affected versions not specified) netapp oncommand unified manager (affected versions not specified) netapp oncommand workflow automation (affected versions not specified) netapp ontap select deploy (affected versions not specified) netapp service processor (affected versions not specified) netapp smi-s provider (affected versions not specified) netapp snapcenter server (affected versions not specified) netapp snapdrive (affected versions not specified) netapp storagegrid (affected versions not specified) netapp storagegrid webscale (affected versions not specified) oracle adaptive access manager (affected versions not specified) oracle application testing suite (affected versions not specified) oracle communications analytics (affected versions not specified) oracle communications ip service activator (affected versions not specified) oracle core rdbms (affected versions not specified) oracle enterprise manager ops center (affected versions not specified) oracle goldengate application adapters (affected versions not specified) oracle jd edwards enterpriseone tools (affected versions not specified) oracle peoplesoft enterprise peopletools (affected versions not specified) oracle retail predictive application server (affected versions not specified) oracle timesten in-memory database (affected versions not specified) oracle weblogic server (affected versions not specified) paloaltonetworks pan-os (affected versions not specified) redhat enterprise linux desktop (affected versions not specified) redhat enterprise linux server (affected versions not specified) redhat enterprise linux server aus (affected versions not specified) redhat enterprise linux server eus (affected versions not specified) redhat enterprise linux server tus (affected versions not specified) redhat enterprise linux workstation (affected versions not specified) redhat jboss enterprise application platform (affected versions not specified)

Description A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.

Recommendations For OpenSSL versions 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0, update to a version that is not affected by this issue. For other affected products, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

ALSA-2025_16880

CESA-2017_0286

CESA-2017_0574

CVE-2016-8610

DLA-814-1

DSA-3773-1

ELSA-2017-0286

ELSA-2017-0574

FREEBSD-SA-16_35

MGASA-2017-0053

OPENSUSE-SU-2017_0386-1

OPENSUSE-SU-2018_4104-1

OPENSUSE-SU-2024:10801-1

RHSA-2017:0286

RHSA-2017:0574

RHSA-2017:1413

RHSA-2017:1414

RHSA-2017:1658

RHSA-2017:1801

RHSA-2017:2493

RHSA-2017_0286

RHSA-2017_0574

SUSE-SU-2017:0304-1

SUSE-SU-2017:0348-1

SUSE-SU-2017:0461-1

SUSE-SU-2017:0495-1

SUSE-SU-2017:0585-1

SUSE-SU-2017:0601-1

SUSE-SU-2017:0605-1

SUSE-SU-2017:2700-1

SUSE-SU-2017_0304-1

SUSE-SU-2017_0348-1

SUSE-SU-2017_0461-1

SUSE-SU-2017_0495-1

SUSE-SU-2017_0585-1

SUSE-SU-2017_0601-1

SUSE-SU-2017_0605-1

SUSE-SU-2018:0112-1

SUSE-SU-2018:3864-1

SUSE-SU-2018:3864-2

SUSE-SU-2018:3964-1

SUSE-SU-2018:3994-1

SUSE-SU-2018:4068-1

SUSE-SU-2018:4274-1

SUSE-SU-2018_0112-1

SUSE-SU-2018_3864-1

SUSE-SU-2018_3864-2

SUSE-SU-2018_3964-1

SUSE-SU-2018_3994-1

SUSE-SU-2018_4068-1

SUSE-SU-2018_4274-1

SUSE-SU-2019:1553-1

SUSE-SU-2019_1553-1

USN-3181-1

USN-3183-1

USN-3183-2

Produtos afetados

Centos

Debian

Freebsd

Fujitsu M10-1

Fujitsu M10-4

Fujitsu M12-1

Fujitsu M12-2

Netapp Cn1610

Netapp Clustered Data Ontap

Netapp Clustered Data Ontap Antivirus Connector

Netapp Data Ontap

Netapp Data Ontap Edge

Netapp E-Series Santricity Os Controller

Netapp Host Agent

Netapp Oncommand Balance

Netapp Oncommand Unified Manager

Netapp Oncommand Workflow Automation

Netapp Ontap Select Deploy

Netapp Smi-S Provider

Netapp Service Processor

Netapp Snapcenter Server

Netapp Snapdrive

Netapp Storagegrid

Netapp Storagegrid Webscale

Openssl

Oracle Adaptive Access Manager

Oracle Application Testing Suite

Oracle Communications Analytics

Oracle Communications Ip Service Activator

Oracle Core Rdbms

Oracle Enterprise Manager Ops Center

Oracle Goldengate Application Adapters

Oracle Jd Edwards Enterpriseone Tools

Oracle Peoplesoft Enterprise Peopletools

Oracle Retail Predictive Application Server

Oracle Timesten In-Memory Database

Oracle Weblogic Server

Palo Alto Networks Pan-Os

Red Hat

Red Hat Enterprise Linux Desktop

Red Hat Enterprise Linux Server

Red Hat Enterprise Linux Workstation

Red Hat Jboss Enterprise Application Platform

Suse

Ubuntu

Referências · 155

• 🔥 https://github.com/cujanovic/CVE-2016-8610-PoC · Exploit
• https://ubuntu.com/security/CVE-2016-7444 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2016/10/24/3 · Nota
• https://suse.com/security/cve/CVE-2017-5337 · Nota
• https://oracle.com/security-alerts/cpujan2020.html · Correção
• https://access.redhat.com/errata/RHSA-2017:1802 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2016-2177 · Aviso do Fabricante
• https://osv.dev/vulnerability/SUSE-SU-2018:0112-1 · Aviso do Fabricante
• https://bugzilla.suse.com/1032261 · Nota
• https://osv.dev/vulnerability/MGASA-2017-0053 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2018-0732 · Nota
• https://bugzilla.suse.com/1027908 · Nota
• https://debian.org/security/2017/dsa-3773 · Aviso do Fabricante
• https://osv.dev/vulnerability/SUSE-SU-2018:4274-1 · Aviso do Fabricante
• https://suse.com/support/update/announcement/2018/suse-su-20183964-1 · Nota