CVE-2016-2107 in Oracle Communications Application Session Controllerinfo

Zusammenfassung (Englisch)

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to obtain sensitive cleartext information via a padding-oracle attack against an AES CBC session. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-0169.

Reservieren

29.01.2016

Veröffentlichung

04.05.2016

Einträge

VulDB provides additional information and datapoints for this CVE:

ID	Schwachstelle	CWE	Aus	Mas	CVE
125384	Oracle Communications Application Session Controller OpenSSL schwache Verschlüsselung	310	Proof-of-Concept	Offizieller Fix	CVE-2016-2107
112014	Oracle Mobile Security Suite OpenSSL schwache Verschlüsselung	310	Proof-of-Concept	Offizieller Fix	CVE-2016-2107
108017	Oracle Communications WebRTC Session Controller OpenSSL schwache Verschlüsselung	310	Proof-of-Concept	Offizieller Fix	CVE-2016-2107
103913	Oracle Communications EAGLE LNP Application Processor OpenSSL Information Disclosure	200	Proof-of-Concept	Offizieller Fix	CVE-2016-2107
103909	Oracle Enterprise Communications Broker OpenSSL Information Disclosure	200	Proof-of-Concept	Offizieller Fix	CVE-2016-2107
103908	Oracle Communications Session Router OpenSSL Information Disclosure	200	Proof-of-Concept	Offizieller Fix	CVE-2016-2107
100030	Oracle Commerce Guided Search/Commerce Experience Manager Platform Services Information Disclosure	200	Proof-of-Concept	Offizieller Fix	CVE-2016-2107
92953	Oracle Sun Ray Operating Software OpenSSL Information Disclosure	200	Proof-of-Concept	Offizieller Fix	CVE-2016-2107
92941	Oracle Primavera P6 Professional Project Management OpenSSL schwache Verschlüsselung	310	Proof-of-Concept	Offizieller Fix	CVE-2016-2107
92940	Oracle Life Sciences Data Hub OpenSSL schwache Verschlüsselung	310	Proof-of-Concept	Offizieller Fix	CVE-2016-2107
92939	Oracle Enterprise Session Border Controller OpenSSL schwache Verschlüsselung	310	Proof-of-Concept	Offizieller Fix	CVE-2016-2107
92938	Oracle Commerce Guided Search/Commerce Experience Manager MDEX schwache Verschlüsselung	310	Proof-of-Concept	Offizieller Fix	CVE-2016-2107
92937	Oracle Transportation Management Install schwache Verschlüsselung	310	Proof-of-Concept	Offizieller Fix	CVE-2016-2107
92935	Oracle Enterprise Manager Ops Center schwache Verschlüsselung	310	Proof-of-Concept	Offizieller Fix	CVE-2016-2107
92756	Oracle Business Intelligence Enterprise Edition Installation Information Disclosure	200	Proof-of-Concept	Offizieller Fix	CVE-2016-2107
90003	Oracle Communications Unified Session Manager Routing Information Disclosure	200	Proof-of-Concept	Offizieller Fix	CVE-2016-2107
89975	Oracle PeopleSoft Enterprise PeopleTools Security Information Disclosure	200	Proof-of-Concept	Offizieller Fix	CVE-2016-2107
89960	Oracle Agile Engineering Data Management Install Information Disclosure	200	Proof-of-Concept	Offizieller Fix	CVE-2016-2107
89917	Oracle Enterprise Manager Base Platform Discovery Information Disclosure	200	Proof-of-Concept	Offizieller Fix	CVE-2016-2107
89903	Oracle Exalogic Infrastructure Base Image Information Disclosure	200	Proof-of-Concept	Offizieller Fix	CVE-2016-2107
89902	Oracle Access Manager Web Server Plugin Information Disclosure	200	Proof-of-Concept	Offizieller Fix	CVE-2016-2107
89773	Apple Mac OS X OpenSSL Information Disclosure	200	Proof-of-Concept	Offizieller Fix	CVE-2016-2107
83255	OpenSSL AES-NI CBC MAC Check e_aes_cbc_hmac_sha1.c schwache Verschlüsselung	310	Proof-of-Concept	Offizieller Fix	CVE-2016-2107

Beschreibung

CPE

CWE

CVSS

Exploits

History

Diff

Verknüpfen

Threat Intelligence

API JSON

API XML

API CSV

◂ ZurückÜbersichtWeiter ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!