Vulnerability   
Search   
    Search 211766 CVE descriptions
and 97459 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.131285
Category:Mageia Linux Local Security Checks
Title:Mageia Linux Local Check: mgasa-2016-0169
Summary:Mageia Linux Local Security Checks mgasa-2016-0169
Description:Summary:
Mageia Linux Local Security Checks mgasa-2016-0169

Vulnerability Insight:
An overflow can occur in the EVP_EncodeUpdate() function which is used for Base64 encoding of binary data. If an attacker is able to supply very large amounts of input data then a length check can overflow resulting in a heap corruption (CVE-2016-2105). An overflow can occur in the EVP_EncryptUpdate() function. If an attacker is able to supply very large amounts of input data after a previous call to EVP_EncryptUpdate() with a partial block then a length check can overflow resulting in a heap corruption (CVE-2016-2106). A MITM attacker can use a padding oracle attack to decrypt traffic when the connection uses an AES CBC cipher and the server support AES-NI (CVE-2016-2107). When ASN.1 data is read from a BIO using functions such as d2i_CMS_bio() a short invalid encoding can casuse allocation of large amounts of memory potentially consuming excessive resources or exhausting memory (CVE-2016-2109)

Solution:
Update the affected packages to the latest available version.

CVSS Score:
7.8

CVSS Vector:
AV:N/AC:L/Au:N/C:N/I:N/A:C

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2016-2105
http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html
BugTraq ID: 89757
http://www.securityfocus.com/bid/89757
BugTraq ID: 91787
http://www.securityfocus.com/bid/91787
Cisco Security Advisory: 20160504 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: May 2016
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160504-openssl
Debian Security Information: DSA-3566 (Google Search)
http://www.debian.org/security/2016/dsa-3566
http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183457.html
http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183607.html
http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184605.html
FreeBSD Security Advisory: FreeBSD-SA-16:17
https://www.freebsd.org/security/advisories/FreeBSD-SA-16:17.openssl.asc
https://security.gentoo.org/glsa/201612-16
http://packetstormsecurity.com/files/136912/Slackware-Security-Advisory-openssl-Updates.html
RedHat Security Advisories: RHSA-2016:0722
http://rhn.redhat.com/errata/RHSA-2016-0722.html
RedHat Security Advisories: RHSA-2016:0996
http://rhn.redhat.com/errata/RHSA-2016-0996.html
RedHat Security Advisories: RHSA-2016:1648
http://rhn.redhat.com/errata/RHSA-2016-1648.html
RedHat Security Advisories: RHSA-2016:1649
http://rhn.redhat.com/errata/RHSA-2016-1649.html
RedHat Security Advisories: RHSA-2016:1650
http://rhn.redhat.com/errata/RHSA-2016-1650.html
RedHat Security Advisories: RHSA-2016:2056
http://rhn.redhat.com/errata/RHSA-2016-2056.html
RedHat Security Advisories: RHSA-2016:2073
http://rhn.redhat.com/errata/RHSA-2016-2073.html
RedHat Security Advisories: RHSA-2016:2957
http://rhn.redhat.com/errata/RHSA-2016-2957.html
http://www.securitytracker.com/id/1035721
http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.542103
SuSE Security Announcement: SUSE-SU-2016:1206 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00001.html
SuSE Security Announcement: SUSE-SU-2016:1228 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00008.html
SuSE Security Announcement: SUSE-SU-2016:1231 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00010.html
SuSE Security Announcement: SUSE-SU-2016:1233 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00011.html
SuSE Security Announcement: SUSE-SU-2016:1267 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00029.html
SuSE Security Announcement: SUSE-SU-2016:1290 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00036.html
SuSE Security Announcement: SUSE-SU-2016:1360 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00055.html
SuSE Security Announcement: openSUSE-SU-2016:1237 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00013.html
SuSE Security Announcement: openSUSE-SU-2016:1238 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00014.html
SuSE Security Announcement: openSUSE-SU-2016:1239 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00015.html
SuSE Security Announcement: openSUSE-SU-2016:1240 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00016.html
SuSE Security Announcement: openSUSE-SU-2016:1241 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00017.html
SuSE Security Announcement: openSUSE-SU-2016:1242 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00018.html
SuSE Security Announcement: openSUSE-SU-2016:1243 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00019.html
SuSE Security Announcement: openSUSE-SU-2016:1273 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00030.html
SuSE Security Announcement: openSUSE-SU-2016:1566 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00019.html
http://www.ubuntu.com/usn/USN-2959-1
Common Vulnerability Exposure (CVE) ID: CVE-2016-2106
BugTraq ID: 89744
http://www.securityfocus.com/bid/89744
Common Vulnerability Exposure (CVE) ID: CVE-2016-2107
BugTraq ID: 89760
http://www.securityfocus.com/bid/89760
https://www.exploit-db.com/exploits/39768/
http://web-in-security.blogspot.ca/2016/05/curious-padding-oracle-in-openssl-cve.html
https://blog.cloudflare.com/yet-another-padding-oracle-in-openssl-cbc-ciphersuites/
Common Vulnerability Exposure (CVE) ID: CVE-2016-2109
BugTraq ID: 87940
http://www.securityfocus.com/bid/87940
CopyrightCopyright (C) 2016 Eero Volotinen

This is only one of 97459 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2021 E-Soft Inc. All rights reserved.