CVE-2016-2105: Integer Overflow
An integer overflow flaw, leading to a buffer overflow, was found in the way the EVPEncodeUpdate() function of OpenSSL parsed very large amounts of input data. A remote attacker could use this flaw to crash an application using OpenSSL or, possibly, execute arbitrary code with the permissions of the user running that application.
Other sources
Integer overflow in the EVPEncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of binary data.
Quoting form the draft of OpenSSL upstream advisory:
EVPEncodeUpdate overflow (CVE-2016-2105) =========================================
Severity: Low
An overflow can occur in the EVPEncodeUpdate() function which is used for Base64 encoding of binary data. If an attacker is able to supply very large amounts of input data then a length check can overflow resulting in a heap corruption.
Internally to OpenSSL the EVPEncodeUpdate() function is primarly used by the PEMwritebio family of functions. These are mainly used within the OpenSSL command line applications. These internal uses are not considered vulnerable because all calls are bounded with length checks so no overflow is possible. User applications that call these APIs directly with large amounts of untrusted data may be vulnerable. (Note: Initial analysis suggested that the PEMwritebio were vulnerable, and this is reflected in the patch commit message. This is no longer believed to be the case).
OpenSSL 1.0.2 users should upgrade to 1.0.2h OpenSSL 1.0.1 users should upgrade to 1.0.1t
This issue was reported to OpenSSL on 3rd March 2016 by Guido Vranken. The fix was developed by Matt Caswell of the OpenSSL development team.
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2016-2105?
CVE-2016-2105 has a critical severity rating due to its potential to allow remote code execution via a buffer overflow.
How do I fix CVE-2016-2105?
To fix CVE-2016-2105, upgrade your OpenSSL to version 1.0.1e-48.el6_8.1 or higher or 1.0.2h-4.jbcs.el6 or higher based on your system.
What systems are affected by CVE-2016-2105?
CVE-2016-2105 affects various versions of OpenSSL including 1.0.1 and 1.0.2 across multiple distributions like Red Hat and Ubuntu.
Can CVE-2016-2105 be exploited remotely?
Yes, CVE-2016-2105 can be exploited remotely, allowing attackers to crash applications or potentially execute arbitrary code.
Is there a workaround for CVE-2016-2105 while I update?
While updating is the best option, limiting access to services using affected OpenSSL versions may serve as a temporary workaround.