Crypto++ (aka cryptopp and libcrypto++) 5.6.4 contained a bug in its ASN.1 BER decoding routine. The library will allocate a memory block based on the length field of the ASN.1 object. If there is not enough content octets in the ASN.1 object, then the function will fail and the memory block will be zeroed even if its unused. There is a noticeable delay during the wipe for a large allocation.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:3301-1 advisory.

  - Crypto++ (aka cryptopp and libcrypto++) 5.6.4 contained a bug in its ASN.1 BER decoding routine. The     library will allocate a memory block based on the length field of the ASN.1 object. If there is not enough     content octets in the ASN.1 object, then the function will fail and the memory block will be zeroed even     if its unused. There is a noticeable delay during the wipe for a large allocation. (CVE-2016-9939)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:3301-1 advisory.

  - Crypto++ (aka cryptopp and libcrypto++) 5.6.4 contained a bug in its ASN.1 BER decoding routine. The     library will allocate a memory block based on the length field of the ASN.1 object. If there is not enough     content octets in the ASN.1 object, then the function will fail and the memory block will be zeroed even     if its unused. There is a noticeable delay during the wipe for a large allocation. (CVE-2016-9939)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Update to 8.2.0.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Gergely G&aacute;bor Nagy from Tresorit discovered that libcrypto++, a C++ cryptographic library, contained a bug in several ASN.1 parsing routines. This would allow an attacker to remotely cause a denial of service.

For Debian 7 'Wheezy', these problems have been fixed in version 5.6.1-6+deb7u3.

We recommend that you upgrade your libcrypto++ packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Gergely Gabor Nagy from Tresorit discovered that libcrypto++, a C++ cryptographic library, contained a bug in several ASN.1 parsing routines. This would allow an attacker to remotely cause a denial of service.

ID	Name	Product	Family	Severity
153909	openSUSE 15 Security Update : libcryptopp (openSUSE-SU-2021:3301-1)	Nessus	SuSE Local Security Checks	high
153906	SUSE SLED15 / SLES15 Security Update : libcryptopp (SUSE-SU-2021:3301-1)	Nessus	SuSE Local Security Checks	high
125656	Fedora 30 : cryptopp (2019-812b77ed2e)	Nessus	Fedora Local Security Checks	medium
96155	Debian DLA-766-1 : libcrypto++ security update	Nessus	Debian Local Security Checks	high
96105	Debian DSA-3748-1 : libcrypto++ - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2016-9939

high

Tenable Plugins

high

high

medium

high

high