Excessive memory allocation in Apple Inc. products - CVE-2016-2109

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU641

Excessive memory allocation in Apple Inc. products - CVE-2016-2109

Published: September 23, 2016 / Updated: January 13, 2017


Vulnerability identifier: #VU641
CSH Severity: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2016-2109
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
OpenSSL
Oracle Solaris
Oracle Linux
macOS
Oracle Access Manager
Oracle Exalogic Infrastructure
Oracle Enterprise Manager Ops Center
PeopleSoft Enterprise PeopleTools
Oracle VM VirtualBox
Oracle E-Business Suite
Oracle Commerce Guided Search
Oracle Agile Engineering Data Management
Oracle Life Sciences Data Hub
Oracle VM Server for x86
Software vendor:
OpenSSL Software Foundation
Oracle
Apple Inc.

Description

The vulnerability allows a remote user to cause excessive memory allocation on the target system.

The weakness exists during reading ASN.1 data by d2i_CMS_bio() function. A short invalid encoding leads to distribution of large amounts of memory for excessive resources or exhausting memory.

Successful exploitation of the vulnerability may result in excessive memory allocation.

Remediation

Update 1.0.1 to 1.01t.
Update 1.0.2. to 1.0.2h.

External links