BSA-2017-201
21539
31 March 2017
31 March 2017
Closed
High
7.5
N/A
CVE-2016-8610
Summary
Security Advisory ID : BSA-2017-201
Component : OpenSSL
Revision : 1.0: Interim
It was found that function "ssl3_read_bytes" in ssl/s3_pkt.c might lead to higher CPU usage due to improper handling of warning packets. An attacker could repeat the undefined plaintext warning packets of "SSL3_AL_WARNING" during the handshake, which will cause a 100% CPU usage on the server. It is an implementation problem in OpenSSL that OpenSSL would ignore undefined warning, and continue dealing with the remaining data (if exist). So the attacker could pack multiple alerts inside a single record and send a large number of these large records. Then the server will be fallen in a meaningless cycle, and not available to any others. BTW, Huzaifa Sidhpurwala from the Red Hat Product Security Team was found that the same issue may also affect gnutls servers.
Affected ProductsProduct | Current Assessment |
---|---|
Brocade 5400 vRouter | Impacted: Fixed in 6.7R13. |
Brocade 5600 vRouter | Impacted: Fixed in 17.2.0. |
Brocade Services Director | Impacted: Fixed in 2.6. |
Brocade SLX-OS | Impacted: Fixed in SLXOS 17r.1.00. |
Brocade FastIron OS, Brocade NetIron OS, Brocade Network Advisor, Brocade SDN Controller, Brocade ServerIron ADX, Brocade Virtual ADX, and Brocade Virtual Web Application Firewall are confirmed not affected by this vulnerability.
WorkaroundThere are no workarounds that address this vulnerability.
Revision History
Version | Change | Date |
---|---|---|
1.0 | Initial Publication | March 31, 2017 |