Loading vulnerability…
OpenSSL Certificate Message Out-of-Bounds Reads
CVE-2016-6306 is an out-of-bounds read vulnerability in OpenSSL certificate-related TLS/SSL handshake processing. Missing message-length checks in client certificate, certificate request, and server certificate message handling can cause reads of up to two bytes beyond an allocated buffer. The vulnerability affects OpenSSL versions before 1.0.1u and the 1.0.2 branch before 1.0.2i; OpenSSL 1.1.0 is unaffected. Crafted handshake messages could theoretically crash a vulnerable client or server when client authentication is enabled.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Potential denial of service through a crash of an application using vulnerable OpenSSL handshake processing. Although malformed messages can trigger short out-of-bounds reads, resulting denial of service had not been observed in practice on common platforms at disclosure. No confidentiality or integrity impact is established for this vulnerability.
If you can’t patch tonight, do this now.
Restrict network access to affected TLS/SSL services to trusted peers and disable unnecessary exposed services until patched. Vendor guidance does not identify a complete workaround; network restrictions reduce exposure but do not correct the parser's missing length checks.
Patch, then assume compromise.
Upgrade OpenSSL 1.0.1 deployments to 1.0.1u or later and OpenSSL 1.0.2 deployments to 1.0.2i or later, or install the applicable vendor-backported security update. Red Hat supplied fixes through RHSA-2016:1940 for RHEL 6 and 7 and RHSA-2018:2185, RHSA-2018:2186, and RHSA-2018:2187 for affected JBoss Core Services deployments. Restart all applications and services linked against the updated OpenSSL library, or reboot, to activate the fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.