PT-2017-3952 · Openssl · Openssl

Tyler Nighswander · Publicado 2017-01-26 · Atualizado 2017-07-28 · CVE-2016-7053

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions OpenSSL versions 1.1.0 through 1.1.0c

Description The issue is related to a NULL pointer dereference in the parsing of CMS structures in the OpenSSL library. This can be exploited by a remote attacker to cause a denial of service. The problem arises from the handling of the ASN.1 CHOICE type, which can result in a NULL value being passed to the structure callback when attempting to free certain invalid encodings.

Recommendations For OpenSSL versions 1.1.0 through 1.1.0c, update to version 1.1.0c or later to resolve the issue. As a temporary workaround, consider restricting the use of the CMS parsing functionality until a patch is available. Avoid using the CHOICE structures that do not handle NULL values in the affected API endpoints until the issue is resolved.

Correção

DoS

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

BDU:2020-02969

CVE-2016-7053

Produtos afetados

Openssl

Referências · 10

• http://securitytracker.com/id/1037261 · Nota
• https://bdu.fstec.ru/vul/2020-02969 · Nota de Segurança
• https://openssl.org/news/secadv/20161110.txt · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-7053 · Nota de Segurança
• https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03744en_us · Nota
• https://osv.dev/vulnerability/CVE-2016-7053 · Aviso do Fabricante
• http://securityfocus.com/bid/94244 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7053 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-7053 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2016-7053 · Aviso do Fabricante