PT-2016-1334 · Openssl+7 · Openssl+7
Emilia Kã¤Sper
·
Published
2016-03-01
·
Updated
2024-06-15
·
CVE-2016-0798
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
OpenSSL versions 1.0.1 through 1.0.1s
OpenSSL versions 1.0.2 through 1.0.2g
Description
The issue is related to errors in resource management in the SRP VBASE get by user function implementation in OpenSSL. It allows a remote attacker to cause a denial of service (memory consumption) by providing an invalid username in a connection attempt. This can lead to a memory leak, potentially causing the service to become unresponsive. Additionally, there is a mention of a side-channel attack that could lead to the recovery of RSA keys, but details are not provided.
Recommendations
For OpenSSL versions 1.0.1 through 1.0.1s, update to version 1.0.1s or later to resolve the issue.
For OpenSSL versions 1.0.2 through 1.0.2g, update to version 1.0.2g or later to resolve the issue.
As a temporary workaround, consider restricting access to the SRP VBASE get by user function to minimize the risk of exploitation.
Fix
DoS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Cisco Nexus
Freebsd
Ibm Aix
Junos
Openssl
Suse
Ubuntu