The BN_bn2dec function in crypto/bn/bn_print.c in OpenSSL before 1.1.0 does not properly validate division results, which allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors.
La función BN_bn2dec en crypto/bn/bn_print.c en OpenSSL en versiones anteriores a 1.1.0 no valida adecuadamente resultados de la división, lo que permite a atacantes remotos provocar una denegación de servicio (escritura fuera de límites y caída de la aplicación) o tener otro posible impacto no especificado a través de vectores desconocidos.
AV:N/AC:L/Au:N/C:P/I:P/A:P
| Access Vector | NETWORK |
|---|---|
| Access Complexity | LOW |
| Authentication | NONE |
| Confidentiality Impact | PARTIAL |
| Integrity Impact | PARTIAL |
| Availability Impact | PARTIAL |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-787
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| hp | icewall_federation_agent | 3.0 | <built-in method update of dict object at 0x72a9b0c29840> | Application |
| hp | icewall_mcrp | 3.0 | <built-in method update of dict object at 0x72a9b0c21300> | Application |
| hp | icewall_sso | 10.0 | <built-in method update of dict object at 0x72a9b0d5bc40> | Application |
| hp | icewall_sso | 10.0 | <built-in method update of dict object at 0x72a9cc7f5380> | Application |
| hp | icewall_sso_agent_option | 10.0 | <built-in method update of dict object at 0x72a9b0c2ae40> | Application |
| openssl | openssl | 1.0.1 | <built-in method update of dict object at 0x72a9b0c28440> | Application |
| openssl | openssl | 1.0.1a | <built-in method update of dict object at 0x72a9b0a789c0> | Application |
| openssl | openssl | 1.0.1b | <built-in method update of dict object at 0x72a9b0c2b240> | Application |
| openssl | openssl | 1.0.1c | <built-in method update of dict object at 0x72a9b0c28740> | Application |
| openssl | openssl | 1.0.1d | <built-in method update of dict object at 0x72a9cdf24c00> | Application |
| openssl | openssl | 1.0.1e | <built-in method update of dict object at 0x72a9cc7f5840> | Application |
| openssl | openssl | 1.0.1f | <built-in method update of dict object at 0x72a9b0c29ac0> | Application |
| openssl | openssl | 1.0.1g | <built-in method update of dict object at 0x72a9b0a7ac00> | Application |
| openssl | openssl | 1.0.1h | <built-in method update of dict object at 0x72a9cc82aa00> | Application |
| openssl | openssl | 1.0.1i | <built-in method update of dict object at 0x72a9b0c2afc0> | Application |
| openssl | openssl | 1.0.1j | <built-in method update of dict object at 0x72a9b0c21100> | Application |
| openssl | openssl | 1.0.1k | <built-in method update of dict object at 0x72a9b0a7a140> | Application |
| openssl | openssl | 1.0.1l | <built-in method update of dict object at 0x72a9b0c23e00> | Application |
| openssl | openssl | 1.0.1m | <built-in method update of dict object at 0x72a9cc41fd40> | Application |
| openssl | openssl | 1.0.1n | <built-in method update of dict object at 0x72a9b0c20700> | Application |
| openssl | openssl | 1.0.1o | <built-in method update of dict object at 0x72a9b0e0d040> | Application |
| openssl | openssl | 1.0.1p | <built-in method update of dict object at 0x72a9b0c20980> | Application |
| openssl | openssl | 1.0.1q | <built-in method update of dict object at 0x72a9b0c23b80> | Application |
| openssl | openssl | 1.0.1r | <built-in method update of dict object at 0x72a9b0c18140> | Application |
| openssl | openssl | 1.0.1s | <built-in method update of dict object at 0x72a9b0a7ae80> | Application |
| openssl | openssl | 1.0.1t | <built-in method update of dict object at 0x72a9b0e0e3c0> | Application |
| openssl | openssl | 1.0.2 | <built-in method update of dict object at 0x72a9b0c290c0> | Application |
| openssl | openssl | 1.0.2a | <built-in method update of dict object at 0x72a9b0c2be40> | Application |
| openssl | openssl | 1.0.2b | <built-in method update of dict object at 0x72a9b0c22c80> | Application |
| openssl | openssl | 1.0.2c | <built-in method update of dict object at 0x72a9b0c18840> | Application |
| openssl | openssl | 1.0.2d | <built-in method update of dict object at 0x72a9b0c1a800> | Application |
| openssl | openssl | 1.0.2e | <built-in method update of dict object at 0x72a9b0c1a3c0> | Application |
| openssl | openssl | 1.0.2f | <built-in method update of dict object at 0x72a9b0c19740> | Application |
| openssl | openssl | 1.0.2g | <built-in method update of dict object at 0x72a9b0c18d00> | Application |
| openssl | openssl | 1.0.2h | <built-in method update of dict object at 0x72a9b0c18ac0> | Application |
| oracle | linux | 5 | <built-in method update of dict object at 0x72a9b0c18340> | Operating System |
| oracle | linux | 6 | <built-in method update of dict object at 0x72a9b0c1b2c0> | Operating System |
| oracle | linux | 7 | <built-in method update of dict object at 0x72a9b0c19600> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:hp:icewall_federation_agent:3.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:hp:icewall_mcrp:3.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:hp:icewall_sso:10.0:*:*:*:certd:*:*:* |
| Yes | cpe:2.3:a:hp:icewall_sso:10.0:*:*:*:dfw:*:*:* |
| Yes | cpe:2.3:a:hp:icewall_sso_agent_option:10.0:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:openssl:openssl:1.0.1:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.1a:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.1b:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.1c:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.1d:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.1e:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.1f:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.1g:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.1h:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.1i:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.1j:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.1k:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.1l:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.1m:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.1n:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.1o:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.1p:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.1q:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.1r:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.1s:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.1t:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2a:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2b:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2c:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2d:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2e:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2f:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2g:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2h:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:oracle:linux:5:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:oracle:linux:6:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:oracle:linux:7:*:*:*:*:*:*:* |