CVE-2016-2107 PoC — OpenSSL AES-NI实现安全漏洞

Source

https://github.com/FiloSottile/CVE-2016-2107

Associated Vulnerability

Title:OpenSSL AES-NI实现安全漏洞 (CVE-2016-2107)
Description:The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to obtain sensitive cleartext information via a padding-oracle attack against an AES CBC session. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-0169.

Description

Simple test for the May 2016 OpenSSL padding oracle (CVE-2016-2107)

Readme

# CVE-2016-2107
Simple test for the May 2016 OpenSSL padding oracle (CVE-2016-2107)

## Installation

```
$ go version
go version go1.6.2 darwin/amd64
$ go get github.com/FiloSottile/CVE-2016-2107
```

This tool only builds with Go 1.6+, and only when downloaded to the right position in the $GOPATH.

## Usage

```
$ CVE-2016-2107 filippo.io
2016/05/03 17:50:49 Vulnerable: false
```

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!