7.5

CVE-2016-6302

The tls_decrypt_ticket function in ssl/t1_lib.c in OpenSSL before 1.1.0 does not consider the HMAC size during validation of the ticket length, which allows remote attackers to cause a denial of service via a ticket that is too short.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
OpenSSL ≫ OpenSSL Version1.0.1
OpenSSL ≫ OpenSSL Version1.0.1a
OpenSSL ≫ OpenSSL Version1.0.1b
OpenSSL ≫ OpenSSL Version1.0.1c
OpenSSL ≫ OpenSSL Version1.0.1d
OpenSSL ≫ OpenSSL Version1.0.1e
OpenSSL ≫ OpenSSL Version1.0.1f
OpenSSL ≫ OpenSSL Version1.0.1g
OpenSSL ≫ OpenSSL Version1.0.1h
OpenSSL ≫ OpenSSL Version1.0.1i
OpenSSL ≫ OpenSSL Version1.0.1j
OpenSSL ≫ OpenSSL Version1.0.1k
OpenSSL ≫ OpenSSL Version1.0.1l
OpenSSL ≫ OpenSSL Version1.0.1m
OpenSSL ≫ OpenSSL Version1.0.1n
OpenSSL ≫ OpenSSL Version1.0.1o
OpenSSL ≫ OpenSSL Version1.0.1p
OpenSSL ≫ OpenSSL Version1.0.1q
OpenSSL ≫ OpenSSL Version1.0.1r
OpenSSL ≫ OpenSSL Version1.0.1s
OpenSSL ≫ OpenSSL Version1.0.1t
OpenSSL ≫ OpenSSL Version1.0.2
OpenSSL ≫ OpenSSL Version1.0.2a
OpenSSL ≫ OpenSSL Version1.0.2b
OpenSSL ≫ OpenSSL Version1.0.2c
OpenSSL ≫ OpenSSL Version1.0.2d
OpenSSL ≫ OpenSSL Version1.0.2e
OpenSSL ≫ OpenSSL Version1.0.2f
OpenSSL ≫ OpenSSL Version1.0.2g
OpenSSL ≫ OpenSSL Version1.0.2h
Oracle ≫ Linux Version6
Oracle ≫ Linux Version7
Oracle ≫ Solaris Version10
Oracle ≫ Solaris Version11.3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 26.44% 0.977
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:N/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
Patch
Third Party Advisory
https://www.tenable.com/security/tns-2016-20
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
Patch
Third Party Advisory
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759
Third Party Advisory
http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html
Patch
Third Party Advisory
http://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.html
Patch
Third Party Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21995039
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-1940.html
http://www.splunk.com/view/SP-CAAAPSV
Third Party Advisory
http://www.splunk.com/view/SP-CAAAPUE
Third Party Advisory
https://bto.bluecoat.com/security-advisory/sa132
Third Party Advisory
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312
Third Party Advisory
https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc
https://www.tenable.com/security/tns-2016-16
Third Party Advisory
https://www.tenable.com/security/tns-2016-21
https://access.redhat.com/errata/RHSA-2018:2185
https://access.redhat.com/errata/RHSA-2018:2186
https://access.redhat.com/errata/RHSA-2018:2187
http://www.securityfocus.com/bid/92628
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1036885
https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=e97763c92c655dcf4af2860b3abd2bc4c8a267f9