Loading vulnerability…
Lucky Minus 20
CVE-2016-2107, known as Lucky Minus 20, is a padding-oracle vulnerability in OpenSSL's AES-NI CBC MAC validation affecting versions before 1.0.1t and the 1.0.2 branch before 1.0.2h. The constant-time padding-check rewrite introduced to fix Lucky Thirteen (CVE-2013-0169) failed to verify that a decrypted record contained sufficient data for both the MAC and padding. A man-in-the-middle attacker can exploit the resulting oracle to recover plaintext from AES-CBC-protected TLS/SSL or DTLS traffic when the server uses the vulnerable AES-NI implementation.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises the confidentiality of encrypted sessions by enabling recovery of sensitive plaintext from intercepted traffic. Exploitation has high attack complexity. This vulnerability does not establish arbitrary code execution, privilege escalation, or service disruption.
If you can’t patch tonight, do this now.
Prevent negotiation of AES-CBC cipher suites where operationally feasible, using supported authenticated-encryption alternatives instead. Restrict access to affected services to trusted networks as a temporary exposure-reduction measure; this does not eliminate the vulnerability for permitted connections. FreeBSD and Sametime bulletins identify no available workaround and require updating.
Patch, then assume compromise.
Upgrade OpenSSL 1.0.1 deployments to 1.0.1t or later and OpenSSL 1.0.2 deployments to 1.0.2h or later, or install the applicable vendor-backported security update. Fixed Red Hat packages include 1.0.1e-48.el6_8.1 for RHEL 6, 1.0.1e-51.el7_2.5 for RHEL 7, and 1.0.1e-42.el6_7.5 for RHEL 6.7 EUS. Echo's affected openssl-1.0.1g packages are corrected in 1.0.1g+e1 or later. Restart all services linked to OpenSSL, or reboot, after updating. These historical upstream fixes identify the minimum corrected releases, not currently supported deployment targets.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit; 1 not yet analyzed, such as Exploit-DB entries.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.