Vulnerable Library - opensslOpenSSL_1_0_1i

TLS/SSL and crypto library

Library home page: https://github.com/openssl/openssl.git

Found in base branch: archived-io.js-v0.10

Vulnerable Source Files (2)

node/deps/openssl/openssl/ssl/s2_srvr.c
node/deps/openssl/openssl/ssl/s2_srvr.c

Vulnerability Details

The get_client_master_key function in s2_srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a accepts a nonzero CLIENT-MASTER-KEY CLEAR-KEY-LENGTH value for an arbitrary cipher, which allows man-in-the-middle attackers to determine the MASTER-KEY value and decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, a related issue to CVE-2016-0800.

Publish Date: 2016-03-02

URL: CVE-2016-0703

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2016-0703

Release Date: 2016-03-02

Fix Resolution: 0.9.8zf,1.0.0r,1.0.1m,1.0.2a