Published: 26/09/2016 Updated: 07/11/2023

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 446

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

The ssl3_read_bytes function in record/rec_layer_s3.c in OpenSSL 1.1.0 prior to 1.1.0a allows remote malicious users to cause a denial of service (infinite loop) by triggering a zero-length record in an SSL_peek call.

Vulnerable Product	Search on Vulmon	Subscribe to Product
openssl openssl 1.1.0

The ssl3_read_bytes function in record/rec_layer_s3c in OpenSSL 110 before 110a allows remote attackers to cause a denial of service (infinite loop) by triggering a zero-length record in an SSL_peek call ...

On September 22, 2016, the OpenSSL Software Foundation released an advisory that describes 14 vulnerabilities Of these 14 vulnerabilities, the OpenSSL Software Foundation classifies one as “Critical Severity,” one as “Moderate Severity,” and the other 12 as “Low Severity” Subsequently, on September 26, the OpenSSL Software Foundatio ...

Nessus is potentially impacted by several vulnerabilities in OpenSSL (20160926) that were recently disclosed and fixed Note that due to the time involved in doing a full analysis of each issue, Tenable has opted to upgrade the included version of OpenSSL as a precaution, and to save time These vulnerabilities may impact Nessus and include: CVE-2 ...

LCE 481 is possibly impacted by multiple vulnerabilities reported in third-party libraries Tenable has not investigated each one to determine if it is exploitable or the vulnerable code path can be reached Instead, Dev has upgraded the impacted libraries as a faster and safer alternative Due to the number of library upgrades and the potential ...

Tenable's Passive Vulnerability Scanner (PVS) uses third-party libraries to provide certain standardized functionality Four of these libraries were found to contain vulnerabilities and were fixed upstream Those fixes have been integrated despite there being no known exploitation scenarios related to PVS OpenSSL ssl/statem/statemc read_state_ma ...

OpenSSL swats a dozen bugs, one notable nasty

The Register • Team Register • 23 Sep 2016

Denial of service dross dead.

A dozen flaws have been patched in OpenSSL, including one high severity hole that allows denial of service attacks. The OpenSSL Project pushed patches in versions 1.1.0a, 1.0.2i and 1.0.1u, with most of the flaws flagged as low severity risks. The nastiest vulnerability (CVE-2016-6304) results when attackers issue a massive OCSP status request extension which exhausts memory on servers in default configuration. Researcher Shi Lei of vulnerability blitzkrieg house Qihoo 360 spotted that one. Admi...

CWE-20 https://www.openssl.org/news/secadv/20160922.txt https://github.com/openssl/openssl/issues/1563 http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html http://www.securityfocus.com/bid/93149 https://security.gentoo.org/glsa/201612-16 https://bto.bluecoat.com/security-advisory/sa132 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759 https://www.tenable.com/security/tns-2016-16 http://www-01.ibm.com/support/docview.wss?uid=swg21995039 http://www.securitytracker.com/id/1036879 http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html https://www.tenable.com/security/tns-2016-21 https://www.tenable.com/security/tns-2016-20 http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=63658103d4441924f8dbfc517b99bb54758a98b9 https://nvd.nist.gov https://www.theregister.co.uk/2016/09/23/openssl_swats_a_dozen_bugs_one_notable_nasty/https://www.cisa.gov/uscert/ics/advisories/icsa-22-349-21 http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160927-openssl

CVE-2016-6305

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

ICS Advisories

Recent Articles

References

Vulmon Search

About

Products

Connect