CVE-2016-0704: Infoleak
An oracle protection mechanism in the getclientmasterkey function in s2srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a overwrites incorrect MASTER-KEY bytes during use of export cipher suites, which makes it easier for remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, a related issue to CVE-2016-0800.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-0704?
CVE-2016-0704 is categorized as a high severity vulnerability due to the risk of exposing sensitive data through flawed encryption.
How do I fix CVE-2016-0704?
To mitigate CVE-2016-0704, update OpenSSL to version 0.9.8zf or later, or version 1.0.0r or later.
Which versions of OpenSSL are affected by CVE-2016-0704?
CVE-2016-0704 affects OpenSSL versions before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a.
What is the vulnerability in CVE-2016-0704 related to?
CVE-2016-0704 is related to an issue in the SSLv2 implementation of OpenSSL that improperly manages MASTER-KEY bytes.
What potential impact does CVE-2016-0704 have on systems?
CVE-2016-0704 could potentially allow an attacker to exploit improper encryption handling to gain unauthorized access to decrypted information.