Vulnerability   
Search   
    Search 202850 CVE descriptions
and 87302 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.107141
Category:SSL and TLS
Title:SSL/TLS: OpenSSL 'CVE-2016-2107' Padding Oracle Vulnerability
Summary:This host is installed with OpenSSL and is prone to padding oracle attack.
Description:Summary:
This host is installed with OpenSSL and is prone to padding oracle attack.

Vulnerability Insight:
The vulnerability is due to not considering memory allocation during a certain
padding check.

Vulnerability Impact:
Exploiting this vulnerability allows remote attackers to obtain sensitive cleartext
information via a padding oracle attack against an AES CBC session.

Affected Software/OS:
OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h.

Solution:
OpenSSL 1.0.2 users should upgrade to 1.0.2h.

OpenSSL 1.0.1 users should upgrade to 1.0.1t.

CVSS Score:
2.6

CVSS Vector:
AV:N/AC:H/Au:N/C:P/I:N/A:N

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2016-2107
http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html
BugTraq ID: 89760
http://www.securityfocus.com/bid/89760
BugTraq ID: 91787
http://www.securityfocus.com/bid/91787
Cisco Security Advisory: 20160504 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: May 2016
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160504-openssl
Debian Security Information: DSA-3566 (Google Search)
http://www.debian.org/security/2016/dsa-3566
https://www.exploit-db.com/exploits/39768/
http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183457.html
http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183607.html
http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184605.html
FreeBSD Security Advisory: FreeBSD-SA-16:17
https://www.freebsd.org/security/advisories/FreeBSD-SA-16:17.openssl.asc
https://security.gentoo.org/glsa/201612-16
http://packetstormsecurity.com/files/136912/Slackware-Security-Advisory-openssl-Updates.html
http://web-in-security.blogspot.ca/2016/05/curious-padding-oracle-in-openssl-cve.html
https://blog.cloudflare.com/yet-another-padding-oracle-in-openssl-cbc-ciphersuites/
RedHat Security Advisories: RHSA-2016:0722
http://rhn.redhat.com/errata/RHSA-2016-0722.html
RedHat Security Advisories: RHSA-2016:0996
http://rhn.redhat.com/errata/RHSA-2016-0996.html
RedHat Security Advisories: RHSA-2016:2073
http://rhn.redhat.com/errata/RHSA-2016-2073.html
RedHat Security Advisories: RHSA-2016:2957
http://rhn.redhat.com/errata/RHSA-2016-2957.html
http://www.securitytracker.com/id/1035721
http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.542103
SuSE Security Announcement: SUSE-SU-2016:1206 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00001.html
SuSE Security Announcement: SUSE-SU-2016:1228 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00008.html
SuSE Security Announcement: SUSE-SU-2016:1233 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00011.html
SuSE Security Announcement: openSUSE-SU-2016:1237 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00013.html
SuSE Security Announcement: openSUSE-SU-2016:1238 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00014.html
SuSE Security Announcement: openSUSE-SU-2016:1240 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00016.html
SuSE Security Announcement: openSUSE-SU-2016:1243 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00019.html
SuSE Security Announcement: openSUSE-SU-2016:1566 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00019.html
http://www.ubuntu.com/usn/USN-2959-1
CopyrightCopyright (C) 2017 Greenbone Networks GmbH

This is only one of 87302 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2021 E-Soft Inc. All rights reserved.