PT-2017-8013 · Openssl+1 · Socat+1

Santiago Zanella-Beguelin · Publicado 2016-02-05 · Atualizado 2017-07-01 · CVE-2016-2217

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Socat versions 1.7.3.0 through 2.0.0-b8

Description The issue lies in the OpenSSL address implementation, which does not utilize a prime number for the Diffie-Hellman (DH) key exchange. This oversight makes it easier for remote attackers to obtain the shared secret, potentially compromising the security of the connection.

Recommendations For Socat version 1.7.3.0, update to a version that uses a prime number for the DH key exchange to prevent remote attackers from obtaining the shared secret. For Socat version 2.0.0-b8, update to a version that uses a prime number for the DH key exchange to prevent remote attackers from obtaining the shared secret.

Correção

Enumeração de Fraquezas

CWE-320

Identificadores relacionados

ALT-PU-2016-1789

CVE-2016-2217

MGASA-2016-0053

Produtos afetados

Alt Linux

Socat

Referências · 15

• https://security-tracker.debian.org/tracker/CVE-2016-2217 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-2217 · Nota de Segurança
• http://openwall.com/lists/oss-security/2016/02/01/4 · Correção
• https://security.gentoo.org/glsa/201612-23 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2016/02/04/1 · Nota
• https://cve.org/CVERecord?id=CVE-2016-2217 · Nota de Segurança
• https://bugs.mageia.org/show_bug.cgi?id=17661 · Nota
• https://osv.dev/vulnerability/MGASA-2016-0053 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-2217 · Aviso do Fabricante
• http://dest-unreach.org/socat/contrib/socat-secadv7.html · Correção
• http://openwall.com/lists/oss-security/2016/02/01/5 · Nota
• https://advisories.mageia.org/MGASA-2016-0053.html · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-2217 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-2217 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2016-2217 · Aviso do Fabricante