CVE-2016-2106: Integer Overflow

Integer overflow in the EVPEncryptUpdate function in crypto/evp/evpenc.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of data.

Quoting form the draft of OpenSSL upstream advisory:

EVPEncryptUpdate overflow (CVE-2016-2106) ==========================================

Severity: Low

An overflow can occur in the EVPEncryptUpdate() function. If an attacker is able to supply very large amounts of input data after a previous call to EVPEncryptUpdate() with a partial block then a length check can overflow resulting in a heap corruption. Following an analysis of all OpenSSL internal usage of the EVPEncryptUpdate() function all usage is one of two forms. The first form is where the EVPEncryptUpdate() call is known to be the first called function after an EVPEncryptInit(), and therefore that specific call must be safe. The second form is where the length passed to EVPEncryptUpdate() can be seen from the code to be some small value and therefore there is no possibility of an overflow. Since all instances are one of these two forms, it is believed that there can be no overflows in internal code due to this problem. It should be noted that EVPDecryptUpdate() can call EVPEncryptUpdate() in certain code paths. Also EVPCipherUpdate() is a synonym for EVPEncryptUpdate(). All instances of these calls have also been too and it is believed there are no instances in internal usage where an overflow could occur.

This could still represent a security issue for end user code that calls this function directly.

OpenSSL 1.0.2 users should upgrade to 1.0.2h OpenSSL 1.0.1 users should upgrade to 1.0.1t

This issue was reported to OpenSSL on 3rd March 2016 by Guido Vranken. The fix was developed by Matt Caswell of the OpenSSL development team.