CVE-2016-2107 in Oracle Communications Application Session Controllerinfo

Summary

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to obtain sensitive cleartext information via a padding-oracle attack against an AES CBC session. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-0169.

Reservation

01/29/2016

Disclosure

05/04/2016

Entries

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerability	CWE	Exp	Cou	CVE
125384	Oracle Communications Application Session Controller OpenSSL cryptographic issue	310	Proof-of-Concept	Official fix	CVE-2016-2107
112014	Oracle Mobile Security Suite OpenSSL cryptographic issue	310	Proof-of-Concept	Official fix	CVE-2016-2107
108017	Oracle Communications WebRTC Session Controller OpenSSL cryptographic issue	310	Proof-of-Concept	Official fix	CVE-2016-2107
103913	Oracle Communications EAGLE LNP Application Processor OpenSSL information disclosure	200	Proof-of-Concept	Official fix	CVE-2016-2107
103909	Oracle Enterprise Communications Broker OpenSSL information disclosure	200	Proof-of-Concept	Official fix	CVE-2016-2107
103908	Oracle Communications Session Router OpenSSL information disclosure	200	Proof-of-Concept	Official fix	CVE-2016-2107
100030	Oracle Commerce Guided Search/Commerce Experience Manager Platform Services information disclosure	200	Proof-of-Concept	Official fix	CVE-2016-2107
92953	Oracle Sun Ray Operating Software OpenSSL information disclosure	200	Proof-of-Concept	Official fix	CVE-2016-2107
92941	Oracle Primavera P6 Professional Project Management OpenSSL cryptographic issue	310	Proof-of-Concept	Official fix	CVE-2016-2107
92940	Oracle Life Sciences Data Hub OpenSSL cryptographic issue	310	Proof-of-Concept	Official fix	CVE-2016-2107
92939	Oracle Enterprise Session Border Controller OpenSSL cryptographic issue	310	Proof-of-Concept	Official fix	CVE-2016-2107
92938	Oracle Commerce Guided Search/Commerce Experience Manager MDEX cryptographic issue	310	Proof-of-Concept	Official fix	CVE-2016-2107
92937	Oracle Transportation Management Install cryptographic issue	310	Proof-of-Concept	Official fix	CVE-2016-2107
92935	Oracle Enterprise Manager Ops Center cryptographic issue	310	Proof-of-Concept	Official fix	CVE-2016-2107
92756	Oracle Business Intelligence Enterprise Edition Installation information disclosure	200	Proof-of-Concept	Official fix	CVE-2016-2107
90003	Oracle Communications Unified Session Manager Routing information disclosure	200	Proof-of-Concept	Official fix	CVE-2016-2107
89975	Oracle PeopleSoft Enterprise PeopleTools Security information disclosure	200	Proof-of-Concept	Official fix	CVE-2016-2107
89960	Oracle Agile Engineering Data Management Install information disclosure	200	Proof-of-Concept	Official fix	CVE-2016-2107
89917	Oracle Enterprise Manager Base Platform Discovery information disclosure	200	Proof-of-Concept	Official fix	CVE-2016-2107
89903	Oracle Exalogic Infrastructure Base Image information disclosure	200	Proof-of-Concept	Official fix	CVE-2016-2107
89902	Oracle Access Manager Web Server Plugin information disclosure	200	Proof-of-Concept	Official fix	CVE-2016-2107
89773	Apple Mac OS X OpenSSL information disclosure	200	Proof-of-Concept	Official fix	CVE-2016-2107
83255	OpenSSL AES-NI CBC MAC Check e_aes_cbc_hmac_sha1.c cryptographic issue	310	Proof-of-Concept	Official fix	CVE-2016-2107

Description

CPE

CWE

CVSS

Exploits

History

Diff

Relate

Threat Intelligence

API JSON

API XML

API CSV

◂ PreviousOverviewNext ▸

Want to know what is going to be exploited?

We predict KEV entries!