Loading vulnerability…
Integer Overflow in OpenSSL EVP_EncodeUpdate
CVE-2016-2105 is an integer overflow in OpenSSL's EVP_EncodeUpdate() Base64-encoding function, affecting versions before 1.0.1t and the 1.0.2 branch before 1.0.2h. Processing very large amounts of binary input can overflow a length check, leading to a buffer overflow and heap corruption. Applications directly passing large volumes of untrusted data to this API may be vulnerable, potentially allowing application crashes or arbitrary code execution. OpenSSL's internal calls through the PEM_write_bio* family are not considered vulnerable because their input lengths are bounded.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation can corrupt application heap memory and crash the affected process, causing denial of service. Arbitrary code execution with the privileges of the user running the application is also possible, although it is not an established outcome for every affected application.
If you can’t patch tonight, do this now.
Until patched, prevent applications from passing very large untrusted inputs to EVP_EncodeUpdate() by enforcing conservative input-size limits before the API call. Restrict access to application interfaces exposing this processing path where feasible. These measures reduce exposure but do not correct the underlying integer overflow.
Patch, then assume compromise.
Upgrade OpenSSL 1.0.1 deployments to 1.0.1t or later and OpenSSL 1.0.2 deployments to 1.0.2h or later, or install vendor packages containing the backported fix. Fixed Red Hat packages include 1.0.1e-48.el6_8.1 for RHEL 6, 1.0.1e-51.el7_2.5 for RHEL 7, and 1.0.1e-42.el6_7.5 for RHEL 6.7 EUS. Restart all applications and services linked to OpenSSL, or reboot the system, after updating. Account for vendor backports rather than relying solely on upstream version comparisons.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
22 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.