Loading vulnerability…
OpenSSL ASN.1 Negative Zero Memory Corruption
CVE-2016-2108 is a memory-corruption vulnerability in the ASN.1 implementation of OpenSSL before 1.0.1o and in the 1.0.2 branch before 1.0.2c. Encoding zero represented as a negative ASN.1 integer causes a buffer underflow and out-of-bounds write in i2c_ASN1_INTEGER. A separate parsing defect in d2i_ASN1_TYPE can interpret a large universal ASN.1 tag as negative zero. Together, these defects allow attacker-controlled ASN.1 structures containing an ANY field to trigger memory corruption when deserialized and subsequently reserialized. Applications that parse and re-encode X.509 certificates are affected; certain certificate-signature verification paths can also trigger the flaw. Successful exploitation can crash the affected application or potentially execute arbitrary code.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
The out-of-bounds write can corrupt application memory, causing a crash and denial of service. With suitable memory-allocation behavior, the corruption may be exploitable for arbitrary code execution with the privileges of the application using OpenSSL, potentially compromising data and operations accessible to that application. Code execution is conditional rather than guaranteed, and exploitability depends on the application's processing path and allocator implementation.
If you can’t patch tonight, do this now.
Restrict access to affected network services to trusted systems while updates are pending. For affected Siemens SCALANCE X-200RNA deployments, restrict SSH and HTTPS access to trusted IP addresses and deactivate the webserver if unnecessary and supported. These exposure-reduction measures do not correct the underlying ASN.1 memory-corruption defect.
Patch, then assume compromise.
Upgrade affected upstream OpenSSL 1.0.1 installations to at least 1.0.1o and affected 1.0.2 installations to at least 1.0.2c, or install vendor packages containing the backported fix. Fixed Red Hat builds include 1.0.1e-48.el6_8.1 for RHEL 6, 1.0.1e-51.el7_2.5 for RHEL 7, and 1.0.1e-42.el6_7.5 for RHEL 6.7 EUS. Restart every service linked to OpenSSL, or reboot, after updating. Assess vendor package status rather than relying solely on the upstream version number. For affected Siemens SCALANCE X-200RNA devices, install firmware V3.2.7 or later.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.