PT-2016-1333 · Openssl+9 · Openssl+12

Guido Vranken

·

Published

2016-03-01

·

Updated

2024-06-15

·

CVE-2016-0797

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions OpenSSL versions 1.0.1 through 1.0.1s OpenSSL versions 1.0.2 through 1.0.2g
Description The issue is caused by multiple integer overflows in the OpenSSL library, allowing remote attackers to cause a denial of service or possibly have other impacts via a long digit string that is mishandled by the BN dec2bn or BN hex2bn function. This is related to the files crypto/bn/bn.h and crypto/bn/bn print.c. A side-channel attack was also found, which makes use of cache-bank conflicts on the Intel Sandy-Bridge microarchitecture, potentially leading to the recovery of RSA keys. Additionally, a cross-protocol attack, referred to as the DROWN attack, was discovered, which actively exploits weaknesses in SSL Version 2 to decrypt passively collected Transport Layer Security sessions.
Recommendations For OpenSSL versions 1.0.1 through 1.0.1s, update to version 1.0.1s or later to resolve the issue. For OpenSSL versions 1.0.2 through 1.0.2g, update to version 1.0.2g or later to resolve the issue. As a temporary workaround, consider restricting the use of the BN dec2bn and BN hex2bn functions until a patch is available. Restrict access to servers that support both SSLv2 and TLS and use the same RSA key pair for both protocols to minimize the risk of the DROWN attack.

Exploit

Fix

Integer Overflow

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

ALT-PU-2016-1184
ALT-PU-2016-1328
BDU:2016-00632
CESA-2016_0301
CVE-2016-0797
DSA-3500-1
MGASA-2016-0093
OPENSUSE-SU-2016_0627-1
OPENSUSE-SU-2016_0628-1
OPENSUSE-SU-2016_0640-1
OPENSUSE-SU-2016_0720-1
OPENSUSE-SU-2016_1241-1
OPENSUSE-SU-2016_1566-1
OPENSUSE-SU-2024:10271-1
OPENSUSE-SU-2024:10529-1
OPENSUSE-SU-2024:11127-1
RHSA-2016:0301
RHSA-2016:0302
RHSA-2016:0379
RHSA-2016_0301
RHSA-2016_0302
SUSE-FU-2022:0445-1
SUSE-SU-2016:0617-1
SUSE-SU-2016:0620-1
SUSE-SU-2016:0621-1
SUSE-SU-2016:0624-1
SUSE-SU-2016:0631-1
SUSE-SU-2016:0641-1
SUSE-SU-2016:0748-1
SUSE-SU-2016:0778-1
SUSE-SU-2016:0786-1
SUSE-SU-2016:1057-1
USN-2914-1

Affected Products

Alt Linux
Centos
Cisco Asa
Cisco Ios
Cisco Nexus
Cisco Wls
Freebsd
Ibm Aix
Junos
Openssl
Red Hat
Suse
Ubuntu