Denial of service in OpenSSL and Oracle VM VirtualBox - CVE-2016-6307

Vulnerability identifier: #VU817

CSH Severity: Low

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-6307

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remore unauthenticated user to cause DoS conditions on the target system.
The weakness is due to insufficient validation of input length. By sending messages with excessive length attackers can cause resource exhaustion that leads to denial of service.
Successful exploitation of the vulnerability allows a malicious user to cause the vulnerably system deny.

OpenSSL
Oracle VM VirtualBox
openssl (Alpine package)
Data ONTAP operating in 7-Mode
openssl
openssl-solibs
SnapDrive for Windows
Network Advisor
Slackware Linux
Puppet Agent
FOS Firmware
Puppet Enterprise

Update 1.1.0 to 1.1.0a.

SnapDrive for Windows - update to 7.1.4
Data ONTAP operating in 7-Mode - update to 8.2.5
openssl - addressed in versions 1.0.1u, 1.0.2i
openssl-solibs - addressed in versions 1.0.1u, 1.0.2i
Puppet Agent - update to 1.7.1
FOS Firmware - addressed in versions 7.4.2a, 8.01c
Network Advisor - update to 14.0.2
Puppet Enterprise - update to 2016.4.0

• https://www.openssl.org/news/secadv/20160922.txt
• http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

• Denial of service in OpenSSL
• Denial of service in openssl (Alpine package)
• Multiple vulnerabilities in IBM FOS Firmware
• Multiple vulnerabilities in Multiple N series Products
• Slackware Linux update for openssl
• Puppet Enterprise and Puppet Agent update for OpenSSL