CVE-2016-2842: Buffer Overflow

Q: What is the severity of CVE-2016-2842?

CVE-2016-2842 has a severity rating that allows remote attackers to cause a denial of service through out-of-bounds write or memory consumption.

Q: How do I fix CVE-2016-2842?

To fix CVE-2016-2842, update OpenSSL to version 1.0.1s or 1.0.2g or later.

Q: Which versions are affected by CVE-2016-2842?

CVE-2016-2842 affects OpenSSL versions 1.0.1 through 1.0.1r and 1.0.2 through 1.0.2f.

Q: Can CVE-2016-2842 lead to data breaches?

While CVE-2016-2842 primarily leads to denial of service, it could potentially expose a system to further attacks if exploited.

Q: What software should I upgrade to mitigate CVE-2016-2842?

To mitigate CVE-2016-2842, upgrade affected software packages such as OpenSSL from the specified vulnerable versions.

Published Mar 3, 2016

Updated

It was found that doaproutch function in crypto/bio/bprint.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not verify that a certain memory allocation succeeds, which allows remote attackers to cause a denial of service (out-of-bounds write or memory consumption) or possibly have unspecified other impact via a long string, as demonstrated by a large amount of ASN.1 data. This issues is different than CVE-2016-0799.

Upstream patch:

https://git.openssl.org/?p=openssl.git;a=commit;h=578b956fe741bf8e84055547b1e83c28dd902c73

Other sources

Several flaws were found in the way BIOprintf functions were implemented in OpenSSL. Applications which passed large amounts of untrusted data through these functions could crash or potentially execute code with the permissions of the user running such an application.

The doaproutch function in crypto/bio/bprint.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not verify that a certain memory allocation succeeds, which allows remote attackers to cause a denial of service (out-of-bounds write or memory consumption) or possibly have unspecified other impact via a long string, as demonstrated by a large amount of ASN.1 data, a different vulnerability than CVE-2016-0799.

Affected Software

38 affected componentsFixes available

redhat/openssl<1.0.1

1.0.1

redhat/openssl<1.0.2

1.0.2

redhat/openssl<0:1.0.1e-48.el6_8.1

0:1.0.1e-48.el6_8.1

redhat/openssl<0:1.0.1e-42.el6_7.5

0:1.0.1e-42.el6_7.5

redhat/openssl<1:1.0.1e-51.el7_2.5

1:1.0.1e-51.el7_2.5

Advantech Spectre RT ERT351 firmware Versions 5.1.3 and prior

OpenSSL OpenSSL=1.0.1

OpenSSL OpenSSL=1.0.1-beta1

OpenSSL OpenSSL=1.0.1-beta2

OpenSSL OpenSSL=1.0.1-beta3

OpenSSL OpenSSL=1.0.1a

OpenSSL OpenSSL=1.0.1b

OpenSSL OpenSSL=1.0.1c

OpenSSL OpenSSL=1.0.1d

OpenSSL OpenSSL=1.0.1e

OpenSSL OpenSSL=1.0.1f

OpenSSL OpenSSL=1.0.1g

OpenSSL OpenSSL=1.0.1h

OpenSSL OpenSSL=1.0.1i

OpenSSL OpenSSL=1.0.1j

OpenSSL OpenSSL=1.0.1k

OpenSSL OpenSSL=1.0.1l

OpenSSL OpenSSL=1.0.1m

OpenSSL OpenSSL=1.0.1n

OpenSSL OpenSSL=1.0.1o

OpenSSL OpenSSL=1.0.1p

OpenSSL OpenSSL=1.0.1q

OpenSSL OpenSSL=1.0.1r

OpenSSL OpenSSL=1.0.2

OpenSSL OpenSSL=1.0.2-beta1

OpenSSL OpenSSL=1.0.2-beta2

OpenSSL OpenSSL=1.0.2-beta3

OpenSSL OpenSSL=1.0.2a

OpenSSL OpenSSL=1.0.2b

OpenSSL OpenSSL=1.0.2c

OpenSSL OpenSSL=1.0.2d

OpenSSL OpenSSL=1.0.2e

OpenSSL OpenSSL=1.0.2f

Event History

Mar 3, 2016

CVE Published

12:00 AM

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is the severity of CVE-2016-2842?

CVE-2016-2842 has a severity rating that allows remote attackers to cause a denial of service through out-of-bounds write or memory consumption.

How do I fix CVE-2016-2842?

To fix CVE-2016-2842, update OpenSSL to version 1.0.1s or 1.0.2g or later.

Which versions are affected by CVE-2016-2842?