Input validation error in Botan and Debian Linux - CVE-2016-2194

Vulnerability identifier: #VU40300

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-2194

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The ressol function in Botan before 1.10.11 and 1.11.x before 1.11.27 allows remote attackers to cause a denial of service (infinite loop) via unspecified input to the OS2ECP function, related to a composite modulus.

Botan
Debian Linux
Gentoo Linux
Fedora
monotone
botan
qca
code-editor
qt-creator

Install update from vendor's website.

monotone - addressed in versions 1.1-13.fc22, 1.1-13.fc23
botan - addressed in versions 1.8.15-1.el5, 1.8.15-1.el6, 1.10.12-1.el7, 1.10.12-1.fc22, 1.10.12-1.fc23
qca - addressed in versions 2.1.1-4.fc22, 2.1.1-4.fc23
code-editor - addressed in versions 2.8.1-13.fc22, 2.8.1-13.fc23
qt-creator - addressed in versions 3.5.1-2.el7, 3.6.0-6.fc22, 3.6.0-6.fc23

• http://botan.randombit.net/security.html
• http://marc.info/?l=botan-devel&m=145435148602911&w=2
• http://marc.info/?l=botan-devel&m=145449001708138&w=2
• http://www.debian.org/security/2016/dsa-3565
• https://security.gentoo.org/glsa/201612-38

• Input validation error in Debian Linux
• Gentoo update for Botan
• Fedora 23 update for botan, code-editor, monotone, qca, qt-creator
• Fedora 22 update for botan, code-editor, monotone, qca, qt-creator
• Fedora EPEL 7 update for botan, qt-creator
• Fedora EPEL 5 update for botan
• Fedora EPEL 6 update for botan