#VU817 Denial of service in OpenSSL and Oracle VM VirtualBox - CVE-2016-6307

Vulnerability identifier: #VU817

Vulnerability risk: Low

CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2016-6307

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerable software:
OpenSSL
Oracle VM VirtualBox

Software vendor:
OpenSSL Software Foundation
Oracle

The vulnerability allows a remore unauthenticated user to cause DoS conditions on the target system.
The weakness is due to insufficient validation of input length. By sending messages with excessive length attackers can cause resource exhaustion that leads to denial of service.
Successful exploitation of the vulnerability allows a malicious user to cause the vulnerably system deny.

Update 1.1.0 to 1.1.0a.

• https://www.openssl.org/news/secadv/20160922.txt
• http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html