PT-2017-8013 · Openssl+1 · Socat+1

Santiago Zanella-Beguelin · Published 2016-02-05 · Updated 2017-07-01 · CVE-2016-2217

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Socat versions 1.7.3.0 through 2.0.0-b8

Description The issue lies in the OpenSSL address implementation, which does not utilize a prime number for the Diffie-Hellman (DH) key exchange. This oversight makes it easier for remote attackers to obtain the shared secret, potentially compromising the security of the connection.

Recommendations For Socat version 1.7.3.0, update to a version that uses a prime number for the DH key exchange to prevent remote attackers from obtaining the shared secret. For Socat version 2.0.0-b8, update to a version that uses a prime number for the DH key exchange to prevent remote attackers from obtaining the shared secret.

Fix

Weakness Enumeration

CWE-320

Related Identifiers

ALT-PU-2016-1789

CVE-2016-2217

MGASA-2016-0053

Affected Products

Alt Linux

Socat

References · 15

• https://security-tracker.debian.org/tracker/CVE-2016-2217 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-2217 · Security Note
• http://openwall.com/lists/oss-security/2016/02/01/4 · Patch
• https://security.gentoo.org/glsa/201612-23 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-2217 · Security Note
• https://osv.dev/vulnerability/MGASA-2016-0053 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-2217 · Vendor Advisory
• http://dest-unreach.org/socat/contrib/socat-secadv7.html · Patch
• https://advisories.mageia.org/MGASA-2016-0053.html · Security Note
• https://osv.dev/vulnerability/CVE-2016-2217 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-2217 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-2217 · Vendor Advisory
• http://openwall.com/lists/oss-security/2016/02/04/1 · Note
• https://bugs.mageia.org/show_bug.cgi?id=17661 · Note
• http://openwall.com/lists/oss-security/2016/02/01/5 · Note