PT-2017-9049 · Matrixssl · Matrixssl

Hanno Böck · Publicado 2017-01-13 · Atualizado 2017-01-19 · CVE-2016-6887

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions MatrixSSL versions 3.8.6 and earlier

Description The issue concerns the pstm exptmod function, which does not properly perform modular exponentiation. This could allow remote attackers to predict the secret key via a CRT attack.

Recommendations For MatrixSSL versions 3.8.6 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2016-6887

Produtos afetados

Matrixssl

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-6887 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-6887 · Aviso do Fabricante
• http://matrixssl.org/blog/releases/matrixssl_3_8_4 · Aviso do Fabricante
• https://blog.fuzzing-project.org/51-Fun-with-Bignums-Crashing-MatrixSSL-and-more.html · Nota