CVE-2016-0703— OpenSSL 安全漏洞

一分钟漏洞结论

复制摘要 复制引用

影响对象

n/a n/a

利用判断

利用概率较高，应尽快评估

建议动作

优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。

OpenSSL在实现SSL/TLS（SSL，安全套接层协议；TLS，安全传输层协议，用于在两个应用程序通信时间提供保密性和完整性保护。）系列协议过程中，支持多个版本的SSL协议，包括SSLv2、SSLv3等协议。 OpenSSL的SSLv2实现过程存在安全漏洞。攻击者可利用编号为CNNVD-201603-001的漏洞发起DROWN攻击，破解采用TLS协议加密的会话数据，利用编号为CNNVD-201603-005的漏洞缩短完成上述攻击的攻击时间。以下版本受到影响：OpenSSL 0.9.8zf之前版本，1.

CVE-2016-0703 影响 n/a n/a。利用概率较高，应尽快评估。OpenSSL在实现SSL/TLS（SSL，安全套接层协议；TLS，安全传输层协议，用于在两个应用程序通信时间提供保密性和完整性保护。）系列协议过程中，支持多个版本的SSL协议，包括SSLv2、SSLv3等协议。 OpenSSL的SSLv2实现过程存在安全漏洞。攻击者可利用编号为CNNVD-201603-001的漏洞发起DROWN攻击，破解采用TLS协议加密 CVE-2016-0703 漏洞详情，神龙漏洞库，https://cve.imfht.com/detail/CVE-2016-0703

一、 漏洞 CVE-2016-0703 基础信息

受影响产品

二、漏洞 CVE-2016-0703 的公开POC

三、漏洞 CVE-2016-0703 的情报信息

CVE-2016-0703 厂商安全公告 (8)

• http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
• http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759
• https://www.openssl.org/news/secadv/20160301.txt
• https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
• http://www.securityfocus.com/bid/83743 vdb-entry
• http://www.securitytracker.com/id/1035133 vdb-entry
• https://security.gentoo.org/glsa/201603-15 vendor-advisory
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160302-openssl vendor-advisory

CVE-2016-0703 邮件列表归档 (12)

• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00004.html vendor-advisory
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00002.html vendor-advisory
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00001.html vendor-advisory
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00007.html vendor-advisory
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00017.html vendor-advisory
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00003.html vendor-advisory
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00012.html vendor-advisory
• http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00038.html vendor-advisory
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00009.html vendor-advisory
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00006.html vendor-advisory
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00025.html vendor-advisory
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00010.html vendor-advisory

CVE-2016-0703 其他参考 (11)

• https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=ae50d8270026edf5b3c7f8aaa0c6677462b33d97
• https://drownattack.com
• http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html
• http://openssl.org/news/secadv/20160301.txt
• https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03741en_us
• http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
• https://www.arista.com/en/support/advisories-notices/security-advisories/1260-security-advisory-18
• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40168
• https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05141441
• http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
• https://security.FreeBSD.org/advisories/FreeBSD-SA-16:12.openssl.asc vendor-advisory

• https://www.cve.org/CVERecord?id=CVE-2016-0703

同批安全公告 · n/a · 2016-03-02 · 共 4 条

IV. Related Vulnerabilities

V. Comments for CVE-2016-0703