Quick answers
- Is CVE-2016-9939 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2016-9939 being exploited in the wild.
- How severe is CVE-2016-9939?
- High severity, with a CVSS score of 7.5, published 30 January 2017.
- Which products and versions are affected?
- Crypto++ Project Crypto++ 5.6.4.
- Is there a fix for CVE-2016-9939?
- A patch was published on 2016-12-26: Debian released security update DSA-3748-1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2016-9939 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2016-9939?
- Check whether you run Debian Linux. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A vulnerability exists in the ASN.1 BER decoding routine of Crypto++ 5.6.4. The library allocates memory based on the length field of an ASN.1 object before verifying if sufficient content octets are present. When the decoding fails due to missing content, the library proceeds to zero-fill the entire allocated memory block as a security measure. An attacker can exploit this by providing a maliciously large length field, forcing the library to spend significant CPU time zeroing a large, unused memory block, leading to a denial-of-service (DoS). The issue was identified using the 'honggfuzz' fuzzer and affects several BERDecode functions.
Affected products
- Crypto++ Project Crypto++ 5.6.4
Timeline
- 2016-12-12: disclosed: Public discussion on oss-security mailing list
- 2016-12-26: patched: Debian released security update DSA-3748-1
- 2017-01-30: advisory: NVD publication date