CVE-2016-8610
HIGHOpenSSL 0.9.8 1.0.1 1.0.2-1.0.2h 1.1.0 - Denial of Service via ALERT Packet Processing
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2016-8610. PoCs published by cujanovic, drent.
AI-analyzed exploit summary This repository contains a functional Python script that exploits CVE-2016-8610 (SSL Death Alert) by sending a large number of crafted SSL/TLS alert messages to a target server, causing a denial-of-service condition. The script supports multiple SSL/TLS versions and uses threading to amplify the attack.
Description
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.
Exploits (2)
This repository contains a functional Python script that exploits CVE-2016-8610 (SSL Death Alert) by sending a large number of crafted SSL/TLS alert messages to a target server, causing a denial-of-service condition. The script supports multiple SSL/TLS versions and uses threading to amplify the attack.
This repository contains a functional Python script that exploits CVE-2016-8610, a denial-of-service vulnerability in OpenSSL servers. The script sends a large number of SSL/TLS alert messages to overwhelm the target server.
References (28)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H