Denial of service in OpenSSL and Oracle VM VirtualBox - CVE-2016-6308

Vulnerability identifier: #VU818

CSH Severity: Low

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-6308

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote unauthenticated user to cause DoS conditions on the target system.
The weakness is due to insufficient validation of input length. By sending messages with excessive length attackers can cause resource exhaustion that leads to denial of service.
Successful exploitation of the vulnerability will allow a malicious user to trigger the vulnerable service to deny.

OpenSSL
Oracle VM VirtualBox
SnapDrive for Windows
Network Advisor
Data ONTAP operating in 7-Mode
openssl
openssl-solibs
Slackware Linux
Puppet Agent
FOS Firmware
Puppet Enterprise

Update 1.1.0 to version 1.1.0a.

SnapDrive for Windows - update to 7.1.4
Data ONTAP operating in 7-Mode - update to 8.2.5
openssl - addressed in versions 1.0.1u, 1.0.2i
openssl-solibs - addressed in versions 1.0.1u, 1.0.2i
Puppet Agent - update to 1.7.1
FOS Firmware - addressed in versions 7.4.2a, 8.01c
Network Advisor - update to 14.0.2
Puppet Enterprise - update to 2016.4.0

• https://www.openssl.org/news/secadv/20160922.txt
• http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

• Denial of service in OpenSSL
• Multiple vulnerabilities in IBM FOS Firmware
• Multiple vulnerabilities in Multiple N series Products
• Slackware Linux update for openssl
• Puppet Enterprise and Puppet Agent update for OpenSSL