CVE-2016-6306

openssl: certificate message OOB reads

Severity Score

5.9

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers to cause a denial of service (out-of-bounds read) via crafted certificate operations, related to s3_clnt.c and s3_srvr.c.

El analizador certificado en OpenSSL en versiones anteriores a 1.0.1u y 1.0.2 en versiones anteriores a 1.0.2i podría permitir a atacantes remotos provocar una denegación de servicio (lectura fuera de rango) a través de operaciones certificadas manipuladas, relacionado con s3_clnt.c y s3_srvr.c.

Multiple out of bounds read flaws were found in the way OpenSSL handled certain TLS/SSL protocol handshake messages. A remote attacker could possibly use these flaws to crash a TLS/SSL server or client using OpenSSL.

*Credits: N/A

CVSS Scores

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

Attack Vector

Local

Attack Complexity

High

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2016-07-26 CVE Reserved
2016-09-22 CVE Published
2024-05-03 EPSS Updated
2024-08-06 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-125: Out-of-bounds Read

CAPEC

References (58)

URL	Tag	Source
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759	Third Party Advisory
http://seclists.org/fulldisclosure/2017/Jul/31	Mailing List
http://www-01.ibm.com/support/docview.wss?uid=swg21995039	Third Party Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en	Third Party Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html	Third Party Advisory
http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html	Third Party Advisory
http://www.securityfocus.com/bid/93153	Third Party Advisory
http://www.securitytracker.com/id/1036885	Third Party Advisory
https://bto.bluecoat.com/security-advisory/sa132	Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=52e623c4cb06fffa9d5e75c60b34b4bc130b12e9
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05302448	Third Party Advisory
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448	Third Party Advisory
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312	Third Party Advisory
https://kc.mcafee.com/corporate/index?page=content&id=SB10215	Third Party Advisory
https://support.f5.com/csp/article/K90492697	Third Party Advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en&docId=emr_na-hpesbhf03856en_us	Third Party Advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us	Third Party Advisory
https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24	Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2020.html	Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2020.html	Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html	Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html	Third Party Advisory
https://www.tenable.com/security/tns-2016-16	Third Party Advisory
https://www.tenable.com/security/tns-2016-20	Third Party Advisory
https://www.tenable.com/security/tns-2016-21	Third Party Advisory

URL	Date	SRC

URL	Date	SRC
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html	2023-11-07
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html	2023-11-07
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html	2023-11-07
http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html	2023-11-07
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html	2023-11-07
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html	2023-11-07

URL	Date	SRC
http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html	2023-11-07
http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html	2023-11-07
http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html	2023-11-07
http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html	2023-11-07
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html	2023-11-07
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html	2023-11-07
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html	2023-11-07
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html	2023-11-07
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00021.html	2023-11-07
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html	2023-11-07
http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html	2023-11-07
http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html	2023-11-07
http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html	2023-11-07
http://rhn.redhat.com/errata/RHSA-2016-1940.html	2023-11-07
http://www.debian.org/security/2016/dsa-3673	2023-11-07
http://www.ubuntu.com/usn/USN-3087-1	2023-11-07
http://www.ubuntu.com/usn/USN-3087-2	2023-11-07
https://access.redhat.com/errata/RHSA-2018:2185	2023-11-07
https://access.redhat.com/errata/RHSA-2018:2186	2023-11-07
https://access.redhat.com/errata/RHSA-2018:2187	2023-11-07
https://nodejs.org/en/blog/vulnerability/september-2016-security-releases	2023-11-07
https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc	2023-11-07
https://security.gentoo.org/glsa/201612-16	2023-11-07
https://www.openssl.org/news/secadv/20160922.txt	2023-11-07
https://access.redhat.com/security/cve/CVE-2016-6306	2018-07-12
https://bugzilla.redhat.com/show_bug.cgi?id=1377594	2018-07-12

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				1.0.1 Search vendor "Openssl" for product "Openssl" and version "1.0.1"		-		Affected
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				1.0.1 Search vendor "Openssl" for product "Openssl" and version "1.0.1"		beta1		Affected
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				1.0.1 Search vendor "Openssl" for product "Openssl" and version "1.0.1"		beta2		Affected
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				1.0.1 Search vendor "Openssl" for product "Openssl" and version "1.0.1"		beta3		Affected
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				1.0.1a Search vendor "Openssl" for product "Openssl" and version "1.0.1a"		-		Affected
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				1.0.1b Search vendor "Openssl" for product "Openssl" and version "1.0.1b"		-		Affected
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				1.0.1c Search vendor "Openssl" for product "Openssl" and version "1.0.1c"		-		Affected
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				1.0.1d Search vendor "Openssl" for product "Openssl" and version "1.0.1d"		-		Affected
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				1.0.1e Search vendor "Openssl" for product "Openssl" and version "1.0.1e"		-		Affected
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				1.0.1f Search vendor "Openssl" for product "Openssl" and version "1.0.1f"		-		Affected
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				1.0.1g Search vendor "Openssl" for product "Openssl" and version "1.0.1g"		-		Affected
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				1.0.1h Search vendor "Openssl" for product "Openssl" and version "1.0.1h"		-		Affected
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				1.0.1i Search vendor "Openssl" for product "Openssl" and version "1.0.1i"		-		Affected
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				1.0.1j Search vendor "Openssl" for product "Openssl" and version "1.0.1j"		-		Affected
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				1.0.1k Search vendor "Openssl" for product "Openssl" and version "1.0.1k"		-		Affected
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				1.0.1l Search vendor "Openssl" for product "Openssl" and version "1.0.1l"		-		Affected
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				1.0.1m Search vendor "Openssl" for product "Openssl" and version "1.0.1m"		-		Affected
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				1.0.1n Search vendor "Openssl" for product "Openssl" and version "1.0.1n"		-		Affected
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				1.0.1o Search vendor "Openssl" for product "Openssl" and version "1.0.1o"		-		Affected
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				1.0.1p Search vendor "Openssl" for product "Openssl" and version "1.0.1p"		-		Affected
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				1.0.1q Search vendor "Openssl" for product "Openssl" and version "1.0.1q"		-		Affected
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				1.0.1r Search vendor "Openssl" for product "Openssl" and version "1.0.1r"		-		Affected
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				1.0.1s Search vendor "Openssl" for product "Openssl" and version "1.0.1s"		-		Affected
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				1.0.1t Search vendor "Openssl" for product "Openssl" and version "1.0.1t"		-		Affected
Hp Search vendor "Hp"		Icewall Federation Agent Search vendor "Hp" for product "Icewall Federation Agent"				3.0 Search vendor "Hp" for product "Icewall Federation Agent" and version "3.0"		-		Affected
Hp Search vendor "Hp"		Icewall Mcrp Search vendor "Hp" for product "Icewall Mcrp"				3.0 Search vendor "Hp" for product "Icewall Mcrp" and version "3.0"		-		Affected
Hp Search vendor "Hp"		Icewall Sso Search vendor "Hp" for product "Icewall Sso"				10.0 Search vendor "Hp" for product "Icewall Sso" and version "10.0"		certd		Affected
Hp Search vendor "Hp"		Icewall Sso Search vendor "Hp" for product "Icewall Sso"				10.0 Search vendor "Hp" for product "Icewall Sso" and version "10.0"		dfw		Affected
Hp Search vendor "Hp"		Icewall Sso Agent Option Search vendor "Hp" for product "Icewall Sso Agent Option"				10.0 Search vendor "Hp" for product "Icewall Sso Agent Option" and version "10.0"		-		Affected
Novell Search vendor "Novell"		Suse Linux Enterprise Module For Web Scripting Search vendor "Novell" for product "Suse Linux Enterprise Module For Web Scripting"				12.0 Search vendor "Novell" for product "Suse Linux Enterprise Module For Web Scripting" and version "12.0"		-		Affected
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				1.0.2 Search vendor "Openssl" for product "Openssl" and version "1.0.2"		-		Affected
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				1.0.2 Search vendor "Openssl" for product "Openssl" and version "1.0.2"		beta1		Affected
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				1.0.2 Search vendor "Openssl" for product "Openssl" and version "1.0.2"		beta2		Affected
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				1.0.2 Search vendor "Openssl" for product "Openssl" and version "1.0.2"		beta3		Affected
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				1.0.2a Search vendor "Openssl" for product "Openssl" and version "1.0.2a"		-		Affected
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				1.0.2b Search vendor "Openssl" for product "Openssl" and version "1.0.2b"		-		Affected
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				1.0.2c Search vendor "Openssl" for product "Openssl" and version "1.0.2c"		-		Affected
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				1.0.2d Search vendor "Openssl" for product "Openssl" and version "1.0.2d"		-		Affected
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				1.0.2e Search vendor "Openssl" for product "Openssl" and version "1.0.2e"		-		Affected
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				1.0.2f Search vendor "Openssl" for product "Openssl" and version "1.0.2f"		-		Affected
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				1.0.2h Search vendor "Openssl" for product "Openssl" and version "1.0.2h"		-		Affected
Nodejs Search vendor "Nodejs"		Node.js Search vendor "Nodejs" for product "Node.js"				>= 0.10.0 < 0.10.47 Search vendor "Nodejs" for product "Node.js" and version " >= 0.10.0 < 0.10.47"		-		Affected
Nodejs Search vendor "Nodejs"		Node.js Search vendor "Nodejs" for product "Node.js"				>= 0.12.0 < 0.12.16 Search vendor "Nodejs" for product "Node.js" and version " >= 0.12.0 < 0.12.16"		-		Affected
Nodejs Search vendor "Nodejs"		Node.js Search vendor "Nodejs" for product "Node.js"				>= 4.0.0 <= 4.1.2 Search vendor "Nodejs" for product "Node.js" and version " >= 4.0.0 <= 4.1.2"		-		Affected
Nodejs Search vendor "Nodejs"		Node.js Search vendor "Nodejs" for product "Node.js"				>= 4.2.0 < 4.6.0 Search vendor "Nodejs" for product "Node.js" and version " >= 4.2.0 < 4.6.0"		lts		Affected
Nodejs Search vendor "Nodejs"		Node.js Search vendor "Nodejs" for product "Node.js"				>= 5.0.0 <= 5.12.0 Search vendor "Nodejs" for product "Node.js" and version " >= 5.0.0 <= 5.12.0"		-		Affected
Nodejs Search vendor "Nodejs"		Node.js Search vendor "Nodejs" for product "Node.js"				>= 6.0.0 < 6.7.0 Search vendor "Nodejs" for product "Node.js" and version " >= 6.0.0 < 6.7.0"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				8.0 Search vendor "Debian" for product "Debian Linux" and version "8.0"		-		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				12.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "12.04"		-		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				14.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "14.04"		esm		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				16.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "16.04"		esm		Affected