PT-2017-10391 · Cryptopp+1 · Crypto+++1

Noloader · Published 2016-12-26 · Updated 2021-10-06 · CVE-2016-9939

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Crypto++ versions 5.6.4

Description The issue is related to a bug in the ASN.1 BER decoding routine of the library. When the library allocates a memory block based on the length field of the ASN.1 object and there are not enough content octets, the function fails and the memory block is zeroed, even if it's unused. This results in a noticeable delay during the wipe for large allocations.

Recommendations For version 5.6.4, consider updating to a newer version that contains a fix for this issue, as the current version has a bug in its ASN.1 BER decoding routine that can cause a noticeable delay during memory wipe for large allocations.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2016-9939

DLA-766-1

DSA-3748-1

MGASA-2017-0010

OPENSUSE-SU-2021:3301-1

OPENSUSE-SU-2021_3301-1

SUSE-SU-2021:3301-1

SUSE-SU-2021_3301-1

Affected Products

Crypto++

Suse

References · 31

• https://osv.dev/vulnerability/DEBIAN-CVE-2016-9939 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-3748-1 · Vendor Advisory
• http://openwall.com/lists/oss-security/2016/12/12/7 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2021:3301-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3748-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-9939 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0010 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-9939 · Security Note
• https://security-tracker.debian.org/tracker/source-package/libcrypto++ · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-9939 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7IL5A6465IEPW5GAWGXB2ENJPFYVWTJM · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:3301-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2017-0010.html · Security Note
• http://debian.org/security/2016/dsa-3748 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-9939 · Security Note