Ask the Community
Groups
CVE-2016-2107: OpenSSL oracle padding vulnerability - Connect IT Community | Kaseya
<main> <article class="userContent"> <h3 data-id="cve-id"><strong>CVE ID</strong></h3> <p>CVE-2016-2107</p> <h3 data-id="description"><strong>DESCRIPTION</strong></h3> <p>The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to obtain sensitive cleartext information via a padding-oracle attack against an AES CBC session, NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-0169.<br><br>Unitrends risk assessment: High<br> </p> <h3 data-id="resolution"><strong>RESOLUTION</strong></h3> <p>For CentOS5, not vulnerable<br>For CentOS6, resolved in openssl-1.0.1e-48.el6_8.1<br><br>This openssl update resolves the following CVEs:<br> CVE-2016-0799, CVE-2016-2105, CVE-2016-2106, CVE-2016-2107<br> CVE-2016-2108, CVE-2016-2109, CVE-2016-2842<br><br><span id="j_id0:j_id7"><span id="j_id0:j_id7:j_id8:j_id369:1:j_id372:2:j_id380">To apply the fix, download the latest Unitrends security update from the ftp site.</span></span><br><br><br> </p> <h3 data-id="link-to-advisories"><strong>LINK TO ADVISORIES</strong></h3> <p></p> <ul><li><a rel="nofollow" href="/home/leaving?allowTrusted=1&target=https%3A%2F%2Fweb.nvd.nist.gov%2Fview%2Fvuln%2Fdetail%3FvulnId%3DCVE-2016-2107%250D%250Ahttps%3A%2F%2Faccess.redhat.com%2Fsecurity%2Fcve%2Fcve-2016-2107%250D%250Ahttps%3A%2F%2Frhn.redhat.com%2Ferrata%2FRHSA-2016-0996.html">https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2107 https://access.redhat.com/security/cve/cve-2016-2107 https://rhn.redhat.com/errata/RHSA-2016-0996.html</a></li></ul> </article> </main>