SB2016111711 - Red Hat Enterprise Linux 6 update for openssl
Published: November 17, 2016 Updated: April 24, 2025
Security Bulletin ID
SB2016111711
Severity
Medium
Patch available
YES
Number of vulnerabilities
2
Exploitation vector
Remote access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 secuirty vulnerabilities.
1) Denial of service (CVE-ID: CVE-2016-6304)
The vulnerability allows a remote unauthenticated user to cause DoS conditions on the target system.The weakness is due to insufficient validation of input length. By sending messages with excessive length attackers can cause resource exhaustion that leads to denial of service
Successful exploitation of the vulnerability allows a malicious user to trigger the vulnerable service to deny.
2) Resource exhaustion (CVE-ID: CVE-2016-6304)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper resource management in OCSP stapling implementation in OpenSSL. A remote attacker can multiple requests with a large OCSP Status Request extension and consume all available memory on the system.
Remediation
Install update from vendor's website.