CVE-2016-2181 | Mend Vulnerability Database

Vulnerability DatabaseCVE-2016-2181

CVE-2016-2181

September 16, 2016

The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0 mishandles early use of a new epoch number in conjunction with a large sequence number, which allows remote attackers to cause a denial of service (false-positive packet drops) via spoofed DTLS records, related to rec_layer_d1.c and ssl3_record.c.

Related Resources (44)

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html

https://www.tenable.com/security/tns-2016-21

http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

https://security-tracker.debian.org/tracker/CVE-2016-2181

https://bto.bluecoat.com/security-advisory/sa132

https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24

http://seclists.org/fulldisclosure/2017/Jul/31

http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html

https://access.redhat.com/security/cve/CVE-2016-2181

http://www-01.ibm.com/support/docview.wss?uid=swg21995039

https://people.canonical.com/~ubuntu-security/cve/CVE-2016-2181

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

http://www.securityfocus.com/bid/92982

http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html

http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html

http://rhn.redhat.com/errata/RHSA-2016-1940.html

http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312

http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html

https://kc.mcafee.com/corporate/index?page=content&id=SB10215

http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html

https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc

http://www.splunk.com/view/SP-CAAAPUE

https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=1fb9fdc3027b27d8eb6a1e6a846435b070980770

https://www.tenable.com/security/tns-2016-16

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html

https://support.f5.com/csp/article/K59298921

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html

https://www.tenable.com/security/tns-2016-20

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

http://www.ubuntu.com/usn/USN-3087-2

http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html

http://www.debian.org/security/2016/dsa-3673

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en

http://www.ubuntu.com/usn/USN-3087-1

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html

http://www.splunk.com/view/SP-CAAAPSV

http://www.securitytracker.com/id/1036690

http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html

Do you need more information?

CVSS v4

Base Score:

8.7

Attack Vector

NETWORK

Attack Complexity

LOW

Attack Requirements

NONE

Privileges Required

NONE

User Interaction

NONE

Vulnerable System Confidentiality

NONE

Vulnerable System Integrity

NONE

Vulnerable System Availability

HIGH

Subsequent System Confidentiality

NONE

Subsequent System Integrity

NONE

Subsequent System Availability

NONE

CVSS v3

Base Score:

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

CVSS v2

Base Score:

5

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

EPSS

Base Score:

23.03