Loading vulnerability…
OpenSSL X509_NAME_oneline EBCDIC Buffer Over-read
CVE-2016-2176 is a buffer over-read in OpenSSL's X509_NAME_oneline() function on EBCDIC systems. Processing ASN.1 strings longer than 1024 bytes can read beyond a stack buffer and return arbitrary process stack data in the output buffer. The vulnerability affects OpenSSL before 1.0.1t and the 1.0.2 branch before 1.0.2h, potentially enabling sensitive information disclosure or denial of service.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker can cause an affected application to include unintended stack-memory contents in the generated output, potentially exposing sensitive process data if that output is accessible to the attacker. The out-of-bounds read can also cause denial of service. Systems that do not use EBCDIC are not affected.
If you can’t patch tonight, do this now.
As a temporary application-level measure on EBCDIC systems, prevent attacker-controlled ASN.1 strings longer than 1024 bytes from reaching X509_NAME_oneline(). This does not replace updating the vulnerable library.
Patch, then assume compromise.
Upgrade OpenSSL 1.0.1 deployments to 1.0.1t or later, or OpenSSL 1.0.2 deployments to 1.0.2h or later. For applications that bundle OpenSSL, install a vendor update incorporating the fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.