Published: 13/11/2017 Updated: 26/01/2024

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 up to and including 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.

Vulnerable Product	Search on Vulmon	Subscribe to Product
openssl openssl 1.1.0
openssl openssl 0.9.8
openssl openssl 1.0.1
openssl openssl
debian debian linux 8.0
redhat enterprise linux desktop 7.0
redhat enterprise linux workstation 7.0
redhat enterprise linux server 7.0
redhat enterprise linux desktop 6.0
redhat enterprise linux server 6.0
redhat enterprise linux workstation 6.0
redhat enterprise linux server tus 7.3
redhat enterprise linux server aus 7.3
redhat enterprise linux server aus 7.4
redhat enterprise linux server eus 7.3
redhat enterprise linux server eus 7.4
redhat enterprise linux server eus 7.5
redhat enterprise linux server tus 7.6
redhat enterprise linux server eus 7.6
redhat enterprise linux server aus 7.6
redhat jboss_enterprise_application_platform 6.0.0
redhat jboss_enterprise_application_platform 6.4.0
netapp cn1610_firmware -
netapp e-series santricity os controller
netapp storagegrid webscale -
netapp data ontap edge -
netapp oncommand balance -
netapp snapdrive -
netapp ontap select deploy -
netapp oncommand workflow automation -
netapp storagegrid -
netapp snapcenter server -
netapp clustered data ontap -
netapp service processor -
netapp oncommand unified manager -
netapp data ontap -
netapp smi-s provider -
netapp host agent -
netapp clustered data ontap antivirus connector -
paloaltonetworks pan-os
oracle jd edwards enterpriseone tools 9.2
oracle weblogic server 12.1.3.0.0
oracle peoplesoft enterprise peopletools 8.56
oracle weblogic server 10.3.6.0.0
oracle weblogic server 12.2.1.3.0
oracle enterprise manager ops center 12.3.3
oracle adaptive access manager 11.1.2.3.0
oracle peoplesoft enterprise peopletools 8.57
oracle application testing suite 13.3.0.1
oracle retail predictive application server 15.0.3
oracle enterprise manager ops center 12.4.0
oracle weblogic server 12.2.1.4.0
oracle peoplesoft enterprise peopletools 8.58
oracle communications ip service activator 7.4.0
oracle core rdbms 11.2.0.4
oracle core rdbms 12.2.0.1
oracle core rdbms 12.1.0.2
oracle core rdbms 19c
oracle core rdbms 18c
oracle goldengate application adapters 12.3.2.1.0
oracle communications analytics 12.1.1
oracle retail predictive application server 16.0.3
oracle communications ip service activator 7.3.4
oracle timesten in-memory database
fujitsu m10-1_firmware
fujitsu m10-4_firmware
fujitsu m10-4s_firmware
fujitsu m12-1_firmware
fujitsu m12-2_firmware
fujitsu m12-2s_firmware

Several vulnerabilities were discovered in OpenSSL: CVE-2016-7056 A local timing attack was discovered against ECDSA P-256 CVE-2016-8610 It was discovered that no limit was imposed on alert packets during an SSL handshake CVE-2017-3731 Robert Swiecki discovered that the RC4-MD5 cipher when running on 32 bit systems could be f ...

GnuTLS could be made to hang if it received specially crafted network traffic ...

Several security issues were fixed in GnuTLS ...

Several security issues were fixed in OpenSSL ...

Synopsis Moderate: openssl security update Type/Severity Security Advisory: Moderate Topic An update for openssl is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scori ...

Synopsis Moderate: gnutls security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Topic An update for gnutls is now available for Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring Syst ...

Synopsis Important: Red Hat JBoss Enterprise Application Platform 6416 natives update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Enterprise Application PlatformRed Hat Product Security has rated this update as having a security impact of Important A Com ...

Synopsis Important: Red Hat JBoss Core Services Apache HTTP Server 2423 Service Pack 1 for RHEL 7 Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Core Services on RHEL 7Red Hat Product Security has rated this update as having a security impact of Important A ...

Synopsis Important: Red Hat JBoss Core Services Apache HTTP Server 2423 Service Pack 1 for RHEL 6 Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Core Services on RHEL 6Red Hat Product Security has rated this update as having a security impact of Important A ...

Synopsis Important: Red Hat JBoss Web Server 310 Service Pack 1 security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Web Server 31 for RHEL 6 and Red Hat JBoss Web Server 31 for RHEL 7Red Hat Product Security has rated this update as having a sec ...

Synopsis Important: Red Hat JBoss Web Server Service Pack 1 security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Web Server 31Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring Sys ...

Synopsis Important: Red Hat JBoss Enterprise Application Platform 6416 natives update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Enterprise Application Platform 64 for Red Hat Enterprise Linux 6 and Red Hat JBoss Enterprise Application Platform 64 for R ...

Synopsis Important: Red Hat JBoss Core Services Apache HTTP Server 2423 Service Pack 1 Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Core ServicesRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability ...

An integer underflow leading to an out of bounds read flaw was found in OpenSSL A remote attacker could possibly use this flaw to crash a 32-bit TLS/SSL server or client using OpenSSL if it used the RC4-MD5 cipher suite (CVE-2017-3731) A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a ...

A denial of service flaw was found in the way the TLS/SSL protocol definedprocessing of ALERT packets during a connection handshake A remote attackercould use this flaw to make a TLS/SSL server consume an excessive amount of CPUand fail to accept connections form other clients (CVE-2016-8610) Multiple flaws were found in the way gnutls processed ...

A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients ...

CVE-2016-8610 (SSL Death Alert) PoC

CVE-2016-8610 PoC CVE-2016-8610 (SSL Death Alert) PoC Usage: python ssl-death-alertpy DOMAIN/IP PORT PROTOCOL-VERSION(SSLv3, TLS10, TLS11, TLS12) NUMBER-OF-ALERTS(1000) THREADS(50) python ssl-death-alertpy testtdl 443 TLS12 1000 50 More info: security360cn/cve/CVE-2016-8610/ securingtomorrowmcafeecom/mcafee-labs/ssl-death-alert-cve-2016-8610-can-cause-

CWE-400 https://security.360.cn/cve/CVE-2016-8610/https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8610 http://seclists.org/oss-sec/2016/q4/224 https://www.debian.org/security/2017/dsa-3773 http://www.securitytracker.com/id/1037084 http://www.securityfocus.com/bid/93841 https://security.FreeBSD.org/advisories/FreeBSD-SA-16:35.openssl.asc https://security.netapp.com/advisory/ntap-20171130-0001/https://access.redhat.com/errata/RHSA-2017:2494 https://access.redhat.com/errata/RHSA-2017:2493 https://access.redhat.com/errata/RHSA-2017:1802 https://access.redhat.com/errata/RHSA-2017:1801 https://access.redhat.com/errata/RHSA-2017:1658 https://access.redhat.com/errata/RHSA-2017:1414 https://access.redhat.com/errata/RHSA-2017:1413 http://rhn.redhat.com/errata/RHSA-2017-1659.html http://rhn.redhat.com/errata/RHSA-2017-1415.html http://rhn.redhat.com/errata/RHSA-2017-0574.html http://rhn.redhat.com/errata/RHSA-2017-0286.html https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03897en_us https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html https://www.oracle.com/security-alerts/cpujan2020.html https://security.paloaltonetworks.com/CVE-2016-8610 https://www.oracle.com/security-alerts/cpuapr2020.html https://www.oracle.com/security-alerts/cpujul2020.html https://www.oracle.com/security-alerts/cpuoct2020.html https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=af58be768ebb690f78530f796e92b8ae5c9a4401 https://nvd.nist.gov https://www.debian.org/security/./dsa-3773 https://github.com/cujanovic/CVE-2016-8610-PoC https://usn.ubuntu.com/3183-2/

Get Started

CVE-2016-8610

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect