OpenSSL Integer Overflow in ssl3_get_client_hello() Lets Remote Users Deny Service
|
|
SecurityTracker Alert ID: 1036088 |
|
SecurityTracker URL: http://securitytracker.com/id/1036088
|
|
CVE Reference:
CVE-2016-2177
(Links to External Site)
|
Date: Jun 14 2016
|
Impact:
Denial of service via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
|
Description:
A vulnerability was reported in OpenSSL. A remote user can cause denial of service conditions on the target system.
A remote user can send specially crafted data to trigger an integer overflow in ssl3_get_client_hello() and potentially cause the target service to crash.
Guido Vranken reported this vulnerability.
|
Impact:
A remote user can cause denial of service conditions.
|
Solution:
The vendor has issued a source code fix, available at:
https://github.com/openssl/openssl/commit/a004e72b95835136d3f1ea90517f706c24c03da7
|
Vendor URL: openssl.org/ (Links to External Site)
|
Cause:
Boundary error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Sep 23 2016 |
(FreeBSD Issues Fix) OpenSSL Integer Overflow in ssl3_get_client_hello() Lets Remote Users Deny Service
FreeBSD has issued a fix for FreeBSD 9.3, 10.1, 10.2, 10.3, and 11.0.
|
|
Oct 17 2016 |
(Oracle Issues Fix for Oracle Linux) OpenSSL Integer Overflow in ssl3_get_client_hello() Lets Remote Users Deny Service
Oracle has issued a fix for Oracle Linux 5.
|
|
Oct 27 2016 |
(HP Issues Advisory for HPE IceWall) OpenSSL Integer Overflow in ssl3_get_client_hello() Lets Remote Users Deny Service
HPE has issued an advisory for HPE IceWall.
|
|
Nov 15 2016 |
(IBM Issues Fix for IBM AIX) OpenSSL Integer Overflow in ssl3_get_client_hello() Lets Remote Users Deny Service
IBM has issued a fix for IBM AIX 5.3, 6.1, 7.1, and 7.2.
|
|
Jan 26 2017 |
(Red Hat Issues Fix for Red Hat JBoss Core Services) OpenSSL Integer Overflow in ssl3_get_client_hello() Lets Remote Users Deny Service
Red Hat has issued a fix for Red Hat JBoss Core Services for Red Hat Enterprise Linux 6 and 7.
|
|
Jan 31 2017 |
(Ubuntu Issues Fix) OpenSSL Integer Overflow in ssl3_get_client_hello() Lets Remote Users Deny Service
Ubuntu has issued a fix for Ubuntu Linux 12.04 LTS, 14.04 LTS, 16.04 LTS, and 16.10.
|
|
Mar 22 2017 |
(IBM Issues Fix for IBM Rational ClearQuest) OpenSSL Integer Overflow in ssl3_get_client_hello() Lets Remote Users Deny Service
IBM has issued a fix for IBM Rational ClearQuest.
|
|
Apr 8 2017 |
(IBM Issues Fix for IBM WebSphere MQ) OpenSSL Integer Overflow in ssl3_get_client_hello() Lets Remote Users Deny Service
IBM has issued a fix for IBM WebSphere MQ on NonStop Server.
|
|
Source Message Contents
|
|
|
[Original Message Not Available for Viewing]
|
|
