Integer overflow in ssl3_get_client_hello() in Oracle products - CVE-2016-2177

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU24

Integer overflow in ssl3_get_client_hello() in Oracle products - CVE-2016-2177

Published: June 24, 2016 / Updated: February 27, 2025


Vulnerability identifier: #VU24
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2016-2177
CWE-ID: CWE-494
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vendor: OpenSSL Software Foundation
Oracle
Affected software:
OpenSSL
Oracle Solaris
Oracle Linux
Oracle VM VirtualBox
Oracle VM Server for x86

Detailed vulnerability description

The vulnerability allows a remote attacker to cause denial of service conditions on the target system.
The vulnerability exists due to a boundary error in ssl3_get_client_hello() function. A remote attacker can cause integer overflow by sending specially crafted data and crash the service.
Successful exploitation of this vulnerability may cause the target service to crash.

How to mitigate CVE-2016-2177

The vendor has issued a source code fix, available at:

https://github.com/openssl/openssl/commit/a004e72b95835136d3f1ea90517f706c24c03da7

Sources