CVE-2016-6309:

CVE-2016-6309: A use-after-free vulnerability in OpenSSL 1.1.0a’s statem/statem.c after a realloc can allow remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted TLS session.

Score
A numerical rating that indicates how dangerous this vulnerability is.

9.8Critical

Published Date:Sep 26, 2016
CISA KEV Date:*No Data*
Industries Affected:20

Threat Predictions

EPSS Score:45.1
EPSS Percentile:98%

Exploitability

Score:3.9
Attack Vector:NETWORK
Attack Complexity:LOW
Privileges Required:NONE
User Interaction:NONE
Scope:UNCHANGED

Impact

Score:5.9
Confidentiality Impact:HIGH
Integrity Impact:HIGH
Availability Impact:HIGH

Description Preview

Overview

This vulnerability concerns a memory-management flaw in OpenSSL 1.1.0a where memory blocks moved by realloc are not accounted for, resulting in a use-after-free condition. An attacker capable of initiating or manipulating TLS sessions could cause a denial of service or, potentially, run arbitrary code on the affected system. The flaw was publicly disclosed in 2016 and has since been mitigated by updates from OpenSSL and various vendors.

Remediation

Upgrade OpenSSL to a fixed version released after the vulnerability was disclosed (apply the appropriate vendor advisories and OpenSSL patches).
Deploy the updated OpenSSL library across all affected systems and restart services that rely on OpenSSL (web servers, application servers, load balancers, etc.).
Rebuild applications linked against OpenSSL and verify that all components are using the patched library.
Test TLS connections and related functionality in a staging environment before rolling to production.
Review vendor advisories for any additional mitigations or configuration recommendations and apply them as guidance dictates.