CVE-2016-6305
OpenSSL Security Advisory 20160922
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
The ssl3_read_bytes function in record/rec_layer_s3.c in OpenSSL 1.1.0 before 1.1.0a allows remote attackers to cause a denial of service (infinite loop) by triggering a zero-length record in an SSL_peek call.
La función ssl3_read_bytes en record/rec_layer_s3.c en OpenSSL 1.1.0 en versiones anteriores a 1.1.0a permite a atacantes remotos provocar una denegación de servicio (bucle infinito) desencadenando un registro de longitud cero en una llamada SSL_peek.
A malicious client can send an excessively large OCSP Status Request extension. If that client continually requests renegotiation, sending a large OCSP Status Request extension each time, then there will be unbounded memory growth on the server. This will eventually lead to a Denial Of Service attack through memory exhaustion. Servers with a default configuration are vulnerable even if they do not support OCSP. Builds using the "no-ocsp" build time option are not affected. Other issues were also addressed.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2016-07-26 CVE Reserved
- 2016-09-22 CVE Published
- 2024-08-06 CVE Updated
- 2024-08-06 First Exploit
- 2025-04-03 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-20: Improper Input Validation
CAPEC
References (18)
| URL | Date | SRC |
|---|---|---|
| https://github.com/openssl/openssl/issues/1563 | 2024-08-06 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://security.gentoo.org/glsa/201612-16 | 2023-11-07 | |
| https://www.openssl.org/news/secadv/20160922.txt | 2023-11-07 |