CVE-2016-2109: Input Validation
A denial of service flaw was found in the way OpenSSL parsed certain ASN.1-encoded data from BIO (OpenSSL's I/O abstraction) inputs. An application using OpenSSL that accepts untrusted ASN.1 BIO input could be forced to allocate an excessive amount of data.
Other sources
An input validation flaw was found in the way OpenSSL parsed certain ASN.1-encoded data from BIO (OpenSSL's I/O abstraction) inputs. An application using OpenSSL that accepts untrusted ASN.1 BIO input could be forced to allocate an excessive amount of data, potentially resulting in a denial of service.
Upstream commit:
https://git.openssl.org/?p=openssl.git;a=commitdiff;h=c62981390d6cf9e3d612c489b8b77c2913b25807
The asn1d2ireadbio function in crypto/asn1/ad2ifp.c in the ASN.1 BIO implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (memory consumption) via a short invalid encoding.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2016-2109?
CVE-2016-2109 is classified as a denial of service vulnerability that can cause applications using OpenSSL to allocate excessive resources.
How do I fix CVE-2016-2109?
To fix CVE-2016-2109, upgrade OpenSSL to version 1.0.1s or 1.0.2 and higher where available.
What versions of OpenSSL are affected by CVE-2016-2109?
Versions of OpenSSL prior to 1.0.1s and including 1.0.1 and 1.0.2 are affected by CVE-2016-2109.
Is there a patch available for CVE-2016-2109?
Yes, patches that address CVE-2016-2109 are available through major distributions or directly from OpenSSL's source.
Can CVE-2016-2109 be exploited remotely?
Yes, CVE-2016-2109 can be exploited remotely if an application using OpenSSL accepts untrusted ASN.1 BIO input.