CVE-2016-0703: Infoleak
The getclientmasterkey function in s2srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a accepts a nonzero CLIENT-MASTER-KEY CLEAR-KEY-LENGTH value for an arbitrary cipher, which allows man-in-the-middle attackers to determine the MASTER-KEY value and decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, a related issue to CVE-2016-0800.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-0703?
CVE-2016-0703 has a high severity rating due to its potential for man-in-the-middle attacks.
How do I fix CVE-2016-0703?
To fix CVE-2016-0703, upgrade to a patched version of OpenSSL that is not vulnerable, specifically versions 0.9.8zf or later, 1.0.0r or later, 1.0.1m or later, or 1.0.2a or later.
What versions of OpenSSL are affected by CVE-2016-0703?
CVE-2016-0703 affects OpenSSL versions prior to 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a.
What type of attacks can CVE-2016-0703 enable?
CVE-2016-0703 can enable man-in-the-middle attacks, allowing attackers to intercept and potentially manipulate communication between clients and servers.
Is CVE-2016-0703 specific to any operating systems?
CVE-2016-0703 is associated with OpenSSL, thus it is relevant to any operating system that uses vulnerable versions of OpenSSL.