PT-2016-3288 · Mysql Server+14 · Mysql Server+16
Shi Lei
·
Published
2016-08-29
·
Updated
2024-06-15
·
CVE-2016-6304
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
OpenSSL versions prior to 1.0.1u
OpenSSL versions prior to 1.0.2i
OpenSSL versions prior to 1.1.0a
MySQL Server versions 5.6.33 and earlier
MySQL Server versions 5.7.15 and earlier
Description
The issue is related to multiple memory leaks in the t1 lib.c file of the OpenSSL library, which can be exploited by remote attackers to cause a denial of service via large OCSP Status Request extensions. This can lead to memory consumption and potentially cause the application to crash. Additionally, a vulnerability in the MySQL Server component can allow a high-privileged attacker with network access to compromise the server, resulting in unauthorized ability to cause a hang or crash.
Recommendations
For OpenSSL versions prior to 1.0.1u, update to version 1.0.1u or later.
For OpenSSL versions prior to 1.0.2i, update to version 1.0.2i or later.
For OpenSSL versions prior to 1.1.0a, update to version 1.1.0a or later.
For MySQL Server versions 5.6.33 and earlier, update to a version later than 5.6.33.
For MySQL Server versions 5.7.15 and earlier, update to a version later than 5.7.15.
As a temporary workaround, consider restricting access to the
t1 lib.c file or disabling the use of large OCSP Status Request extensions until a patch is available.Exploit
Fix
DoS
Memory Leak
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Centos
Cisco Asa
Cisco Nexus
Cisco Wls
Fortios
Freebsd
Huawei Vrp
Ibm Aix
Junos
Mysql Server
Nessus
Openssl
Red Hat
Suse
Ubuntu
Virtualbox