CVE-2016-6308
OpenSSL Security Advisory 20160922
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
statem/statem_dtls.c in the DTLS implementation in OpenSSL 1.1.0 before 1.1.0a allocates memory before checking for an excessive length, which might allow remote attackers to cause a denial of service (memory consumption) via crafted DTLS messages.
statem/statem_dtls.c en la implementación DTLS en OpenSSL 1.1.0 en versiones anteriores a 1.1.0a asigna memoria antes de comprobar el exceso de longitud, lo que podría permitir a atacantes remotos provocar una denegación de servicio (consumo de memoria) a través de mensajes DTLS manipulados.
A malicious client can send an excessively large OCSP Status Request extension. If that client continually requests renegotiation, sending a large OCSP Status Request extension each time, then there will be unbounded memory growth on the server. This will eventually lead to a Denial Of Service attack through memory exhaustion. Servers with a default configuration are vulnerable even if they do not support OCSP. Builds using the "no-ocsp" build time option are not affected. Other issues were also addressed.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2016-07-26 CVE Reserved
- 2016-09-22 CVE Published
- 2024-08-06 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-399: Resource Management Errors
CAPEC
References (16)
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://www.openssl.org/news/secadv/20160922.txt | 2023-11-07 |