cbcvebase.
CVE-2016-2109
published 2016-05-05

CVE-2016-2109: The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in the ASN.1 BIO implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote…

PriorityP345high7.5CVSS 3.0
AVNACLPRNUINSUCNINAH
EPSS
29.21%
98.0th percentile
The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in the ASN.1 BIO implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (memory consumption) via a short invalid encoding.

Affected

32 ranges· showing 25
VendorProductVersion rangeFixed in
appleos_x_el_capitan_v10.11.6_and_security_update_2016-004
debianopenssl< openssl 1.0.2h-1 (bookworm)openssl 1.0.2h-1 (bookworm)
googleandroid
opensslopenssl<= 1.0.1s
opensslopenssl
opensslopenssl
opensslopenssl
opensslopenssl
opensslopenssl
opensslopenssl
opensslopenssl
opensslopenssl
opensslopenssl>= 0 < 1.0.2h-11.0.2h-1
opensslopenssl>= 0 < 1.0.2h-11.0.2h-1
opensslopenssl>= 0 < 1.0.2h-11.0.2h-1
opensslopenssl>= 0 < 1.0.2h-11.0.2h-1
opensslopenssl>= 0 < 1.0.1f-1ubuntu2.191.0.1f-1ubuntu2.19
opensslopenssl>= 0 < 1.0.2g-1ubuntu4.11.0.2g-1ubuntu4.1
paloaltocortex_xdr
paloaltoglobalprotect
paloaltopan-os
redhatenterprise_linux_desktop
redhatenterprise_linux_desktop
redhatenterprise_linux_hpc_node
redhatenterprise_linux_hpc_node

Detection & IOCsextracted from sources · hover to see the quote

  • The vulnerable function is asn1_d2i_read_bio in crypto/asn1/a_d2i_fp.c; monitor for excessive memory allocation triggered by short invalid ASN.1 BIO encodings passed to d2i BIO functions such as d2i_CMS_bio()
  • Applications parsing untrusted data through d2i BIO functions are the attack surface; TLS applications are explicitly noted as NOT affected — focus detection on non-TLS applications accepting untrusted ASN.1 BIO input
  • Alert on processes showing abnormal heap/memory growth consistent with memory exhaustion when processing ASN.1-encoded data from BIO inputs
  • ·Only OpenSSL versions before 1.0.1t and 1.0.2 before 1.0.2h are vulnerable; patched versions are 1.0.1t and 1.0.2h respectively
  • ·TLS applications using OpenSSL are explicitly NOT affected by this CVE; only non-TLS applications that accept untrusted ASN.1 BIO input are at risk
  • ·FreeBSD systems on EBCDIC are not affected by CVE-2016-2176 (a related but distinct CVE); FreeBSD does not run on EBCDIC systems

CVSS provenance

nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.07.8HIGHAV:N/AC:L/Au:N/C:N/I:N/A:C
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.