Loading vulnerability…
OpenSSL Time-Stamp Protocol Out-of-Bounds Read in TS_OBJ_print_bio
CVE-2016-2180 is an out-of-bounds read vulnerability in OpenSSL's RFC 3161 Public Key Infrastructure Time-Stamp Protocol formatting functionality, affecting versions through 1.0.2h. TS_OBJ_print_bio() incorrectly interprets the return value of OBJ_obj2txt() as the number of bytes written rather than the total length required for the textual object identifier. A sufficiently large object identifier can therefore cause a read beyond the output buffer when attacker-controlled timestamp data is printed. This can crash the OpenSSL ts command or another application invoking the affected functionality. OpenSSL's SSL/TLS implementation does not use this functionality.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Printing specially crafted timestamp data can crash the affected process, causing denial of service. Availability impact depends on whether the operation runs as a standalone command or within a service processing untrusted timestamp data. Arbitrary code execution, privilege escalation, and confidentiality or integrity impacts are not established for this vulnerability.
If you can’t patch tonight, do this now.
Until patched, avoid printing untrusted timestamp data with the OpenSSL ts command or applications using TS_OBJ_print_bio(). Restrict access to workflows that accept attacker-supplied timestamp data. Changing TLS settings does not address this vulnerability because the affected functionality is outside the SSL/TLS implementation. Standard BIG-IP configurations do not expose the issue because they do not use the OpenSSL ts command.
Patch, then assume compromise.
Install a vendor-supported OpenSSL update containing the fix. The historical upstream fixes are OpenSSL 1.0.1u and 1.0.2i for their respective branches. Red Hat addressed the issue through RHSA-2016:1940, including packages 1.0.1e-48.el6_8.3 for RHEL 6 and 1.0.1e-51.el7_2.7 for RHEL 7. Echo's affected openssl-1.0.1g packages are fixed in 1.0.1g+e1 or later. Restart applications and services linked against the updated library, or reboot, to ensure the corrected code is loaded.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.