CVE-2016-2178
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
7.3 High
AI Score
Confidence
Low
2.1 Low
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:L/Au:N/C:P/I:N/A:N
0.0005 Low
EPSS
Percentile
16.0%
The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSL through 1.0.2h does not properly ensure the use of constant-time operations, which makes it easier for local users to discover a DSA private key via a timing side-channel attack.
References
eprint.iacr.org/2016/594.pdf
kb.juniper.net/InfoCenter/index?page=content&id=JSA10759
lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html
lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html
lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html
lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html
lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html
lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html
lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html
lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html
lists.opensuse.org/opensuse-security-announce/2016-10/msg00021.html
lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html
lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html
lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html
lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html
rhn.redhat.com/errata/RHSA-2016-1940.html
rhn.redhat.com/errata/RHSA-2016-2957.html
rhn.redhat.com/errata/RHSA-2017-1659.html
seclists.org/fulldisclosure/2017/Jul/31
tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160927-openssl
www-01.ibm.com/support/docview.wss?uid=swg21995039
www.debian.org/security/2016/dsa-3673
www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en
www.openwall.com/lists/oss-security/2016/06/08/10
www.openwall.com/lists/oss-security/2016/06/08/11
www.openwall.com/lists/oss-security/2016/06/08/12
www.openwall.com/lists/oss-security/2016/06/08/2
www.openwall.com/lists/oss-security/2016/06/08/4
www.openwall.com/lists/oss-security/2016/06/08/5
www.openwall.com/lists/oss-security/2016/06/08/6
www.openwall.com/lists/oss-security/2016/06/08/7
www.openwall.com/lists/oss-security/2016/06/08/8
www.openwall.com/lists/oss-security/2016/06/09/2
www.openwall.com/lists/oss-security/2016/06/09/8
www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html
www.securityfocus.com/bid/91081
www.securitytracker.com/id/1036054
www.splunk.com/view/SP-CAAAPSV
www.splunk.com/view/SP-CAAAPUE
www.ubuntu.com/usn/USN-3087-1
www.ubuntu.com/usn/USN-3087-2
access.redhat.com/errata/RHSA-2017:0193
access.redhat.com/errata/RHSA-2017:0194
access.redhat.com/errata/RHSA-2017:1658
bto.bluecoat.com/security-advisory/sa132
bugzilla.redhat.com/show_bug.cgi?id=1343400
cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=399944622df7bd81af62e67ea967c470534090e2
h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05302448
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448
kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312
kc.mcafee.com/corporate/index?page=content&id=SB10215
nodejs.org/en/blog/vulnerability/september-2016-security-releases/
security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc
security.gentoo.org/glsa/201612-16
support.f5.com/csp/article/K53084033
support.hpe.com/hpsc/doc/public/display?docLocale=en&docId=emr_na-hpesbhf03856en_us
support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us
www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24
www.tenable.com/security/tns-2016-16
www.tenable.com/security/tns-2016-20
www.tenable.com/security/tns-2016-21
Social References
More
Related
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
7.3 High
AI Score
Confidence
Low
2.1 Low
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:L/Au:N/C:P/I:N/A:N
0.0005 Low
EPSS
Percentile
16.0%