發現一個跨通訊協定攻擊，使用支援 SSLv2 和 EXPORT 加密套件的伺服器做為 Bleichenbacher RSA padding oracle 時，可能會導致 TLS 工作階段解密。請注意，假設支援 SSLv2 和 EXPORT 加密 (即使是使用不同的通訊協定，例如 SMTP、IMAP 或 POP3) 的其他伺服器共用無弱點伺服器的 RSA 金鑰，則可以將用戶端和無弱點的伺服器之間的流量解密。此弱點稱為 DROWN。
[CVE-2016-0800]

當 OpenSSL 剖析格式錯誤的 DSA 私密金鑰時，發現一個重複釋放錯誤，而且對於從不受信任的來源接收 DSA 私密金鑰的應用程式，可能會導致 DoS 攻擊或記憶體損毀。
此為罕見狀況。[CVE-2016-0705]

SRP 使用者資料庫查閱方法 SRP_VBASE_get_by_user 包含令人混淆的記憶體管理語意；傳回的指標有時候是剛配置的，有時候則由被呼叫者所擁有。呼叫程式碼沒有方法可以區別這兩種情況。
[CVE-2016-0798]

在 BN_hex2bn 函式中，十六進位數的數目是使用 int 值 |i| 計算的。之後 |bn_expand| 是使用值 |i
* 4| 呼叫。對於大的 |i| 值，這可能會導致 |bn_expand| 未配置任何記憶體，因為 |i * 4| 是負的。這可能會將內部 BIGNUM 資料欄位保留為 NULL，進而導致後續的 NULL 指標解除參照。對於非常大的 |i| 值，計算 |i
* 4| 可能是小於 |i| 的正值。在此情況下，記憶體會配置到內部 BIGNUM 資料欄位，但是其大小不足，進而導致堆積損毀。在 BN_dec2bn 中存在類似的問題。如果具有非常大的不受信任十六進位/十進位資料的使用者應用程式曾經呼叫 BN_hex2bn/BN_dec2bn，這可能會有安全性後果。預計這是罕見的情況。[CVE-2016-0797]

計算字串長度時，在 BIO_*printf 函式中處理 '%s' 格式字串時使用的內部 |fmtstr| 函式可能會發生溢位，而且在列印非常長的字串時，可能會造成超出邊界讀取。[CVE-2016-0799]

發現一個利用 Intel Sandy-Bridge 微架構上的 cache-bank 衝突而發動的側通道攻擊，此攻擊可能會導致復原 RSA 金鑰。[CVE-2016-0702]

s2_srvr.c 未強制執行非匯出密碼的清除金鑰長度為 0。如果這些密碼的清除金鑰位元組存在，則會取代加密金鑰位元組。[CVE-2016-0703]

套用匯出加密套件的 Bleichenbacher 防護時，s2_srvr.c 會覆寫主要金鑰中錯誤的位元組。[CVE-2016-0704] 影響：已啟用 SSLv2 通訊協定的伺服器容易受到 'DROWN' 攻擊的影響，此攻擊可讓遠端攻擊者快速攻擊對伺服器建立的許多記錄的 TLS 連線，即使用戶端本身未建立任何 SSLv2 連線，亦是如此。

可將格式錯誤的 DSA 私密金鑰提供給 OpenSSL 應用程式的攻擊者可造成導致拒絕服務情形的記憶體損毀。[CVE-2016-0705]

使用無效使用者名稱連線的攻擊者可造成記憶體洩漏，最終可能會導致拒絕服務情形。
[CVE-2016-0798]

可將格式錯誤的資料插入應用程式的攻擊者可造成導致拒絕服務情形的記憶體損毀。[CVE-2016-0797、CVE-2016-0799]

對於在相同 hyper 執行緒核心上執行的執行緒，若本機攻擊者可控制其中的程式碼，並將其視為正在執行解密之受害者的執行緒，則可復原 RSA 金鑰。[CVE-2016-0702]

可攔截 SSLv2 交握的 eavesdropper 能夠發動有效的分治法金鑰復原攻擊，並使用伺服器做為 oracle 以判斷 SSLv2 主要金鑰，進而僅使用 16 個伺服器連線和可忽略的計算。[CVE-2016-0703]

攻擊者可使用 Bleichenbacher oracle，進而啟用更有效的 DROWN 攻擊變體。[CVE-2016-0704]

遠端 macOS 或 Mac OS X 主機上安裝的 Apple Xcode 版本比 8.1 版舊。因此，會受到 Xcode Server 的 Node.js 元件中多個遠端程式碼執行弱點影響。未經驗證的遠端攻擊者可加以惡意利用，藉此引發拒絕服務情形或執行任意程式碼。

Versions of OpenSSL prior to 1.0.1s, or 1.0.2g are unpatched for the following vulnerabilities :

 - A flaw exists in the 'SRP_VBASE_get_by_user' method in the SRP Server 'apps/s_server.c' that is triggered when handling invalid usernames. With a specially crafted username, a remote attacker can cause the service to leak 300 bytes of memory per connection, exhausting available memory resources.(
 - A flaw exists in the 'doapr_outch()' function in 'crypto/bio/b_print.c' that is triggered when failing to allocate memory, as the function's return value has no way to signal this error to a calling function. This may allow a context-dependent attacker to corrupt memory and crash a process linked against the library or potentially execute arbitrary code.
 - An out-of-bounds read flaw exists in the 'fmtstr()' function in 'crypto/bio/b_print.c' that is triggered when printing very long strings. This may allow a context-dependent attacker to crash a process linked against the library or to disclose memory contents.
 - A NULL pointer dereference flaw exists in the 'BN_hex2bn()' and 'BN_dec2bn()' functions in 'crypto/bn/bn_print.c'. This may allow a context-dependent attacker to trigger a heap corruption, potentially allowing the execution of arbitrary code.
 - SSLv2 contains a flaw in its implementation, allowing for a cross-protocol Bleichenbacher padding oracle attack (an adaptive chosen-ciphertext attack). Such an attack may allow a man-in-the-middle attacker to decrypt intercepted TLS connections via a series of specially crafted connections to an SSLv2 server that uses the same private key. The monitored connections required to conduct this attack can use any version of the SSL or TLS protocols, including TLS 1.2, as long as they all use the same RSA key exchange method. With each connection, the server response will vary enough so as to leak information to the attacker about the secret keys in use for the victim TLS connection. This information can in turn be used to eventually decrypt the entire TLS connection and gain access to all plaintext traffic between the victim and server.
 - A double-free flaw exists that is triggered as user-supplied input is not properly validated when parsing malformed DSA private keys. This may allow an attacker to corrupt memory to cause a denial of service or potentially execute arbitrary code.
 - A side-channel attack exists that is triggered during the handling of the cache-bank conflicts on the Intel Sandy-bridge microarchitecture. This may allow an attacker to gain access to RSA key information.
 - A flaw exists in 's2_srvr.c' that is triggered as it does not properly enforce that the 'clear-key-length' is 0 for non-export ciphers. This may allow an attacker to displace encrypted-key bytes if clear-key bytes are present for these ciphers, which can allow the attacker to gain access to SSLv2 master-key information.
 - A flaw exists in 's2_srvr.c' that is triggered when the incorrect bytes in the master-key are overwritten during the application of Bleichenbacher protection mechanisms for export cipher suites. This may allow an attacker to potentially execute more efficient variants of the DROWN attack.

Double free vulnerability in the dsa_priv_decode function in crypto/dsa/dsa_ameth.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a malformed DSA private key.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

ID	名稱	產品	系列	已發布	已更新	嚴重性
92921	FreeBSD：FreeBSD -- 多個 OpenSSL 弱點 (7b1a4a27-600a-11e6-a6c3-14dae9d210b8) (DROWN)	Nessus	FreeBSD Local Security Checks	2016/8/12	2021/1/4	critical
94935	Apple Xcode < 8.1 Node.js Multiple RCE (macOS)	Nessus	MacOS X Local Security Checks	2016/11/17	2020/5/5	critical
9128	OpenSSL 1.0.1 < 1.0.1s / 1.0.2 < 1.0.2g Multiple Vulnerabilities (DROWN)	Nessus Network Monitor	Web Servers	2016/3/1	2019/3/6	medium
503088	Siemens SCALANCE X-200RNA Switch Devices Improper Input Validation (CVE-2016-0705)	Tenable OT Security	Tenable.ot	2025/3/13	2025/3/13	critical

偵測

搜尋 Plugin

critical

critical

medium

critical