CVE-2016-7053

CMS Null dereference

Severity Score

7.5

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

In OpenSSL 1.1.0 before 1.1.0c, applications parsing invalid CMS structures can crash with a NULL pointer dereference. This is caused by a bug in the handling of the ASN.1 CHOICE type in OpenSSL 1.1.0 which can result in a NULL value being passed to the structure callback if an attempt is made to free certain invalid encodings. Only CHOICE structures using a callback which do not handle NULL value are affected.

En OpenSSL 1.1.0 anterior a 1.1.0c, las aplicaciones que analizan estructuras CMS inválidas pueden dejar de dar servicio por una referencia a puntero nulo. Esto se produce por un fallo en la gestión del tipo ASN.1 CHOICE en OpenSSL 1.1.0, lo que puede derivar en que un valor NULL sea enviado a la devolución de la llamada si se intenta utilizar varias codificaciones inválidas. Sólo están afectadas estructuras CHOICE que utilicen una devolución de llamada que no gestione valores NULL.

*Credits: Tyler Nighswander (ForAllSecure)

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2016-08-23 CVE Reserved
2016-11-10 CVE Published
2024-09-16 CVE Updated
2024-10-14 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-476: NULL Pointer Dereference

CAPEC

References (4)

URL	Tag	Source
http://www.securityfocus.com/bid/94244	Third Party Advisory
http://www.securitytracker.com/id/1037261	Vdb Entry
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03744en_us	X_refsource_confirm

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://www.openssl.org/news/secadv/20161110.txt	2017-07-28

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				1.1.0 Search vendor "Openssl" for product "Openssl" and version "1.1.0"		-		Affected
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				1.1.0a Search vendor "Openssl" for product "Openssl" and version "1.1.0a"		-		Affected
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				1.1.0b Search vendor "Openssl" for product "Openssl" and version "1.1.0b"		-		Affected