NVD Vulnerability Detail

CVE-2016-2178

Summary	The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSL through 1.0.2h does not properly ensure the use of constant-time operations, which makes it easier for local users to discover a DSA private key via a timing side-channel attack.
Publication Date	June 20, 2016, 10:59 a.m.
Registration Date	Jan. 26, 2021, 2:08 p.m.
Last Update	Nov. 21, 2024, 11:47 a.m.

CVSS3.1 : MEDIUM
スコア	5.5
Vector	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
攻撃元区分(AV)	ローカル
攻撃条件の複雑さ(AC)	低
攻撃に必要な特権レベル(PR)	低
利用者の関与(UI)	不要
影響の想定範囲(S)	変更なし
機密性への影響(C)	高
完全性への影響(I)	なし
可用性への影響(A)	なし

CVSS2.0 : LOW
Score	2.1
Vector	AV:L/AC:L/Au:N/C:P/I:N/A:N
攻撃元区分(AV)	ローカル
攻撃条件の複雑さ(AC)	低
攻撃前の認証要否(Au)	不要
機密性への影響(C)	低
完全性への影響(I)	なし
可用性への影響(A)	なし
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	いいえ

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:openssl:openssl:1.0.1m:::::::*
cpe:2.3:a:openssl:openssl:1.0.2a:::::::*
cpe:2.3:a:openssl:openssl:1.0.1j:::::::*
cpe:2.3:a:openssl:openssl:1.0.1h:::::::*
cpe:2.3:a:openssl:openssl:1.0.2e:::::::*
cpe:2.3:a:openssl:openssl:1.0.1r:::::::*
cpe:2.3:a:openssl:openssl:1.0.2b:::::::*
cpe:2.3:a:openssl:openssl:1.0.1c:::::::*
cpe:2.3:a:openssl:openssl:1.0.1g:::::::*
cpe:2.3:a:openssl:openssl:1.0.2g:::::::*
cpe:2.3:a:openssl:openssl:1.0.1a:::::::*
cpe:2.3:a:openssl:openssl:1.0.2h:::::::*
cpe:2.3:a:openssl:openssl:1.0.1d:::::::*
cpe:2.3:a:openssl:openssl:1.0.1t:::::::*
cpe:2.3:a:openssl:openssl:1.0.2c:::::::*
cpe:2.3:a:openssl:openssl:1.0.1p:::::::*
cpe:2.3:a:openssl:openssl:1.0.1k:::::::*
cpe:2.3:a:openssl:openssl:1.0.1b:::::::*
cpe:2.3:a:openssl:openssl:1.0.1n:::::::*
cpe:2.3:a:openssl:openssl:1.0.1q:::::::*
cpe:2.3:a:openssl:openssl:1.0.1e:::::::*
cpe:2.3:a:openssl:openssl:1.0.1l:::::::*
cpe:2.3:a:openssl:openssl:1.0.1f:::::::*
cpe:2.3:a:openssl:openssl:1.0.1s:::::::*
cpe:2.3:a:openssl:openssl:1.0.1o:::::::*
cpe:2.3:a:openssl:openssl:1.0.2:::::::*
cpe:2.3:a:openssl:openssl:1.0.2f:::::::*
cpe:2.3:a:openssl:openssl:1.0.1i:::::::*
cpe:2.3:a:openssl:openssl:1.0.1:::::::*
cpe:2.3:a:openssl:openssl:1.0.2d:::::::*

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:oracle:solaris:11.3:::::::*
cpe:2.3:o:oracle:linux:5:::::::*
cpe:2.3:o:oracle:solaris:10:::::::*
cpe:2.3:o:oracle:linux:6:::::::*
cpe:2.3:o:oracle:linux:7:::::::*

Configuration3		or higher	or less	more than	less than
cpe:2.3:o:suse:linux_enterprise:12.0:::::::*

Configuration4	or higher	or less	more than	less than
cpe:2.3:a:nodejs:node.js:::::-:::*	4.0.0	4.1.2
cpe:2.3:a:nodejs:node.js:::::-:::*	0.12.0			0.12.16
cpe:2.3:a:nodejs:node.js:::::-:::*	0.10.0			0.10.47
cpe:2.3:a:nodejs:node.js:::::lts:::*	4.2.0			4.6.0
cpe:2.3:a:nodejs:node.js:::::-:::*	5.0.0			6.7.0

Configuration5		or higher	or less	more than	less than
cpe:2.3:o:debian:debian_linux:8.0:::::::*

Configuration6	or higher	or less	more than	less than
cpe:2.3:o:canonical:ubuntu_linux:14.04::::esm:::
cpe:2.3:o:canonical:ubuntu_linux:16.04::::esm:::
cpe:2.3:o:canonical:ubuntu_linux:12.04::::-:::

Related information, measures and tools

No	URL	タグ
1	http://eprint.iacr.org/2016/594.pdf	Technical Description Third Party Advisory
2	http://eprint.iacr.org/2016/594.pdf	Technical Description Third Party Advisory
3	http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759	Third Party Advisory
4	http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759	Third Party Advisory
5	http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html	Mailing List Third Party Advisory
6	http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html	Mailing List Third Party Advisory
7	http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html	Mailing List Third Party Advisory
8	http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html	Mailing List Third Party Advisory
9	http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html	Mailing List Third Party Advisory
10	http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html	Mailing List Third Party Advisory
11	http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html	Mailing List Third Party Advisory
12	http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html	Mailing List Third Party Advisory
13	http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html	Mailing List Third Party Advisory
14	http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html	Mailing List Third Party Advisory
15	http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html	Mailing List Third Party Advisory
16	http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html	Mailing List Third Party Advisory
17	http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html	Mailing List Third Party Advisory
18	http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html	Mailing List Third Party Advisory
19	http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html	Third Party Advisory
20	http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html	Third Party Advisory
21	http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00021.html	Mailing List Third Party Advisory
22	http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00021.html	Mailing List Third Party Advisory
23	http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html	Mailing List Third Party Advisory
24	http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html	Mailing List Third Party Advisory
25	http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html	Mailing List Third Party Advisory
26	http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html	Mailing List Third Party Advisory
27	http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html	Mailing List Third Party Advisory
28	http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html	Mailing List Third Party Advisory
29	http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html	Mailing List Third Party Advisory
30	http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html	Mailing List Third Party Advisory
31	http://rhn.redhat.com/errata/RHSA-2016-1940.html	Third Party Advisory
32	http://rhn.redhat.com/errata/RHSA-2016-1940.html	Third Party Advisory
33	http://rhn.redhat.com/errata/RHSA-2016-2957.html	Third Party Advisory
34	http://rhn.redhat.com/errata/RHSA-2016-2957.html	Third Party Advisory
35	http://rhn.redhat.com/errata/RHSA-2017-1659.html	Third Party Advisory
36	http://rhn.redhat.com/errata/RHSA-2017-1659.html	Third Party Advisory
37	http://seclists.org/fulldisclosure/2017/Jul/31	Mailing List Third Party Advisory
38	http://seclists.org/fulldisclosure/2017/Jul/31	Mailing List Third Party Advisory
39	http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160927-openssl	Third Party Advisory
40	http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160927-openssl	Third Party Advisory
41	http://www.debian.org/security/2016/dsa-3673	Third Party Advisory
42	http://www.debian.org/security/2016/dsa-3673	Third Party Advisory
43	http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en	Third Party Advisory
44	http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en	Third Party Advisory
45	http://www.openwall.com/lists/oss-security/2016/06/08/10	Mailing List Third Party Advisory
46	http://www.openwall.com/lists/oss-security/2016/06/08/10	Mailing List Third Party Advisory
47	http://www.openwall.com/lists/oss-security/2016/06/08/11	Mailing List Third Party Advisory
48	http://www.openwall.com/lists/oss-security/2016/06/08/11	Mailing List Third Party Advisory
49	http://www.openwall.com/lists/oss-security/2016/06/08/12	Mailing List Third Party Advisory
50	http://www.openwall.com/lists/oss-security/2016/06/08/12	Mailing List Third Party Advisory
51	http://www.openwall.com/lists/oss-security/2016/06/08/2	Mailing List Patch Third Party Advisory
52	http://www.openwall.com/lists/oss-security/2016/06/08/2	Mailing List Patch Third Party Advisory
53	http://www.openwall.com/lists/oss-security/2016/06/08/4	Mailing List Third Party Advisory
54	http://www.openwall.com/lists/oss-security/2016/06/08/4	Mailing List Third Party Advisory
55	http://www.openwall.com/lists/oss-security/2016/06/08/5	Mailing List Third Party Advisory
56	http://www.openwall.com/lists/oss-security/2016/06/08/5	Mailing List Third Party Advisory
57	http://www.openwall.com/lists/oss-security/2016/06/08/6	Mailing List Third Party Advisory
58	http://www.openwall.com/lists/oss-security/2016/06/08/6	Mailing List Third Party Advisory
59	http://www.openwall.com/lists/oss-security/2016/06/08/7	Mailing List Third Party Advisory
60	http://www.openwall.com/lists/oss-security/2016/06/08/7	Mailing List Third Party Advisory
61	http://www.openwall.com/lists/oss-security/2016/06/08/8	Mailing List Third Party Advisory
62	http://www.openwall.com/lists/oss-security/2016/06/08/8	Mailing List Third Party Advisory
63	http://www.openwall.com/lists/oss-security/2016/06/09/2	Mailing List Third Party Advisory
64	http://www.openwall.com/lists/oss-security/2016/06/09/2	Mailing List Third Party Advisory
65	http://www.openwall.com/lists/oss-security/2016/06/09/8	Mailing List Third Party Advisory
66	http://www.openwall.com/lists/oss-security/2016/06/09/8	Mailing List Third Party Advisory
67	http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html	Patch Third Party Advisory
68	http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html	Patch Third Party Advisory
69	http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html	Patch Third Party Advisory
70	http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html	Patch Third Party Advisory
71	http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html	Patch Third Party Advisory
72	http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html	Patch Third Party Advisory
73	http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html	Patch Third Party Advisory
74	http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html	Patch Third Party Advisory
75	http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html	Patch Third Party Advisory
76	http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html	Patch Third Party Advisory
77	http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html	Third Party Advisory
78	http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html	Third Party Advisory
79	http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html	Third Party Advisory
80	http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html	Third Party Advisory
81	http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html	Third Party Advisory
82	http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html	Third Party Advisory
83	http://www.securityfocus.com/bid/91081	Third Party Advisory VDB Entry
84	http://www.securityfocus.com/bid/91081	Third Party Advisory VDB Entry
85	http://www.securitytracker.com/id/1036054	Third Party Advisory VDB Entry
86	http://www.securitytracker.com/id/1036054	Third Party Advisory VDB Entry
87	http://www.splunk.com/view/SP-CAAAPSV	Third Party Advisory
88	http://www.splunk.com/view/SP-CAAAPSV	Third Party Advisory
89	http://www.splunk.com/view/SP-CAAAPUE	Third Party Advisory
90	http://www.splunk.com/view/SP-CAAAPUE	Third Party Advisory
91	http://www.ubuntu.com/usn/USN-3087-1	Third Party Advisory
92	http://www.ubuntu.com/usn/USN-3087-1	Third Party Advisory
93	http://www.ubuntu.com/usn/USN-3087-2	Third Party Advisory
94	http://www.ubuntu.com/usn/USN-3087-2	Third Party Advisory
95	http://www-01.ibm.com/support/docview.wss?uid=swg21995039	Third Party Advisory
96	http://www-01.ibm.com/support/docview.wss?uid=swg21995039	Third Party Advisory
97	https://access.redhat.com/errata/RHSA-2017:0193	Third Party Advisory
98	https://access.redhat.com/errata/RHSA-2017:0193	Third Party Advisory
99	https://access.redhat.com/errata/RHSA-2017:0194	Third Party Advisory
100	https://access.redhat.com/errata/RHSA-2017:0194	Third Party Advisory
101	https://access.redhat.com/errata/RHSA-2017:1658	Third Party Advisory
102	https://access.redhat.com/errata/RHSA-2017:1658	Third Party Advisory
103	https://bto.bluecoat.com/security-advisory/sa132	Third Party Advisory
104	https://bto.bluecoat.com/security-advisory/sa132	Third Party Advisory
105	https://bugzilla.redhat.com/show_bug.cgi?id=1343400	Issue Tracking Patch
106	https://bugzilla.redhat.com/show_bug.cgi?id=1343400	Issue Tracking Patch
107	https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
108	https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
109	https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=399944622df7bd81af62e67ea967c470534090e2
110	https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=399944622df7bd81af62e67ea967c470534090e2
111	https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05302448	Third Party Advisory
112	https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05302448	Third Party Advisory
113	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448	Third Party Advisory
114	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448	Third Party Advisory
115	https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312	Third Party Advisory
116	https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312	Third Party Advisory
117	https://kc.mcafee.com/corporate/index?page=content&id=SB10215	Third Party Advisory
118	https://kc.mcafee.com/corporate/index?page=content&id=SB10215	Third Party Advisory
119	https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/	Third Party Advisory
120	https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/	Third Party Advisory
121	https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc	Third Party Advisory
122	https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc	Third Party Advisory
123	https://security.gentoo.org/glsa/201612-16	Third Party Advisory VDB Entry
124	https://security.gentoo.org/glsa/201612-16	Third Party Advisory VDB Entry
125	https://support.f5.com/csp/article/K53084033	Third Party Advisory
126	https://support.f5.com/csp/article/K53084033	Third Party Advisory
127	https://support.hpe.com/hpsc/doc/public/display?docLocale=en&docId=emr_na-hpesbhf03856en_us	Third Party Advisory
128	https://support.hpe.com/hpsc/doc/public/display?docLocale=en&docId=emr_na-hpesbhf03856en_us	Third Party Advisory
129	https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us	Third Party Advisory
130	https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us	Third Party Advisory
131	https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24	Third Party Advisory
132	https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24	Third Party Advisory
133	https://www.tenable.com/security/tns-2016-16	Third Party Advisory
134	https://www.tenable.com/security/tns-2016-16	Third Party Advisory
135	https://www.tenable.com/security/tns-2016-20	Third Party Advisory
136	https://www.tenable.com/security/tns-2016-20	Third Party Advisory
137	https://www.tenable.com/security/tns-2016-21	Third Party Advisory
138	https://www.tenable.com/security/tns-2016-21	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-203	セキュリティ関連の処理に対するレスポンスの違いに起因する情報漏えい	https://cwe.mitre.org/data/definitions/203.html

JVN Vulnerability Information

OpenSSL の crypto/dsa/dsa_ossl.c の dsa_sign_setup 関数における DSA 秘密鍵を取得される脆弱性

Title	OpenSSL の crypto/dsa/dsa_ossl.c の dsa_sign_setup 関数における DSA 秘密鍵を取得される脆弱性
Summary	OpenSSL の crypto/dsa/dsa_ossl.c の dsa_sign_setup 関数は、一定時間のオペレーション使用を適切に確認しないため、DSA 秘密鍵を取得される脆弱性が存在します。
Possible impacts	ローカルユーザにより、タイミングサイドチャネル攻撃を介して、DSA 秘密鍵を取得される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	June 6, 2016, midnight
Registration Date	June 22, 2016, 3 p.m.
Last Update	Oct. 3, 2017, 2:28 p.m.

Affected System

オラクル

Oracle Linux 5

Oracle Linux 6

Oracle Linux 7

Oracle Solaris 10

Oracle Solaris 11.3

OpenSSL Project

OpenSSL 1.0.2h まで

日本電気

CapsSuite V3.0 から V4.0

EnterpriseIdentityManager

ESMPRO/ServerAgent 4.4.22-1以降

ESMPRO/ServerAgentService 全バージョン (Linux版)

Express5800 SG3600全シリーズ

IX1000シリーズ

IX2000シリーズ

IX3000シリーズ

SecureWare/PKIアプリケーション開発キット Ver3.2

WebOTX Application Server Enterprise V8.2 から V9.4

WebOTX Application Server Express V8.2 から V9.4

WebOTX Application Server Foundation V8.2 から V8.5

WebOTX Application Server Standard V8.2 から V9.4

WebOTX Enterprise Service Bus V8.2 から V8.5

WebOTX Portal V8.2 から V9.1

SUSE

SUSE Linux Enterprise Module for Web Scripting 12

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2016-2178	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2178
National Vulnerability Database (NVD)
2	CVE-2016-2178	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2178

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-200	https://jvndb.jvn.jp/ja/cwe/CWE-200.html

ベンダー情報

No	Name	URL
Cisco Security Advisory
1	cisco-sa-20160927-openssl	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160927-openssl
HPE Security Bulletin
2	HPSBGN03658	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448
IBM Support Document
3	1995039	http://www-01.ibm.com/support/docview.wss?uid=swg21995039
NEC製品セキュリティ情報
4	NV17-001	http://jpn.nec.com/security-info/secinfo/nv17-001.html
News
5	OpenSSL 1.0.1 Series Release Notes	https://www.openssl.org/news/openssl-1.0.1-notes.html
6	OpenSSL 1.0.2 Series Release Notes	https://www.openssl.org/news/openssl-1.0.2-notes.html
Node.js Foundation
7	Security updates for all active release lines, September 2016	https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/
OpenSSL Project
8	Fix DSA, preserve BN_FLG_CONSTTIME	https://git.openssl.org/?p=openssl.git;a=commit;h=399944622df7bd81af62e67ea967c470534090e2
opensuse-security-announce
9	SUSE-SU-2016:2470	https://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html
Oracle Critical Patch Update
10	Oracle Critical Patch Update Advisory - October 2016	http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
Oracle Technology Network
11	Oracle Linux Bulletin - October 2016	http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
12	Oracle Solaris Third Party Bulletin - April 2016	http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
13	Oracle VM Server for x86 Bulletin - October 2016	http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html
Red Hat Bugzilla
14	Bug 1343400	https://bugzilla.redhat.com/show_bug.cgi?id=1343400
Security Advisories
15	SA132	https://bto.bluecoat.com/security-advisory/sa132
16	SA40312	https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312
Security Bulletin
17	JSA10759	http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759
Splunk
18	Splunk Enterprise 6.4.5 addresses multiple vulnerabilities	http://www.splunk.com/view/SP-CAAAPUE
19	Splunk Enterprise 6.5.1 addresses multiple OpenSSL vulnerabilities	http://www.splunk.com/view/SP-CAAAPSV
Tenable Network Security
20	TNS-2016-16	https://www.tenable.com/security/tns-2016-16
Turbolinux Security Advisory
21	TLSA-2016-17	http://www.turbolinux.co.jp/security/2016/TLSA-2016-17j.html

その他

No	Name	URL
JVN
1	JVNVU#98667810	http://jvn.jp/vu/JVNVU98667810/index.html
関連文書
2	BizMobile Go! 脆弱性対応状況	http://www.bizmobile.co.jp/news_02.php?id=4069&nc=1

Change Log

No	Changed Details	Date of change
0	[2016年06月22日] 掲載 [2016年08月03日] ベンダ情報：ターボリナックス (TLSA-2016-17) を追加 [2016年10月07日] ベンダ情報：OpenSSL Project (OpenSSL 1.0.1 Series Release Notes) を追加ベンダ情報：OpenSSL Project (OpenSSL 1.0.2 Series Release Notes) を追加ベンダ情報：シスコシステムズ (cisco-sa-20160927-openssl) を追加参考情報：JVN (JVNVU#98667810) を追加 [2016年11月17日] ベンダ情報：Node.js Foundation (Security updates for all active release lines, September 2016) を追加ベンダ情報：ヒューレット・パッカード・エンタープライズ (HPSBGN03658) を追加ベンダ情報：オラクル (Oracle Critical Patch Update Advisory - October 2016) を追加ベンダ情報：オラクル (Oracle Linux Bulletin - October 2016) を追加ベンダ情報：オラクル (Oracle Solaris Third Party Bulletin - April 2016) を追加ベンダ情報：オラクル (Oracle VM Server for x86 Bulletin - October 2016) を追加参考情報：関連文書 (BizMobile Go! 脆弱性対応状況) を追加 [2017年02月21日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：日本電気 (NV17-001) を追加ベンダ情報：パルスセキュア (SA40312) を追加ベンダ情報：ジュニパーネットワークス (JSA10759) を追加ベンダ情報：ブルーコートシステムズ (SA132) を追加ベンダ情報：IBM (1995039) を追加ベンダ情報：Tenable Network Security (TNS-2016-16) を追加ベンダ情報：Splunk (Splunk Enterprise 6.4.5 addresses multiple vulnerabilities) を追加ベンダ情報：Splunk (Splunk Enterprise 6.5.1 addresses multiple OpenSSL vulnerabilities) を追加 [2017年03月09日] 影響を受けるシステム：ベンダ情報の更新に伴い内容を更新 [2017年07月25日] 影響を受けるシステム：ベンダ情報 (NV17-001) の更新に伴い内容を更新 [2017年10月03日] 影響を受けるシステム：内容を更新ベンダ情報：SUSE (SUSE-SU-2016:2470) を追加	Feb. 17, 2018, 10:37 a.m.

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:openssl:openssl:1.0.1m:::::::*
cpe:2.3:a:openssl:openssl:1.0.2a:::::::*
cpe:2.3:a:openssl:openssl:1.0.1j:::::::*
cpe:2.3:a:openssl:openssl:1.0.1h:::::::*
cpe:2.3:a:openssl:openssl:1.0.2e:::::::*
cpe:2.3:a:openssl:openssl:1.0.1r:::::::*
cpe:2.3:a:openssl:openssl:1.0.2b:::::::*
cpe:2.3:a:openssl:openssl:1.0.1c:::::::*
cpe:2.3:a:openssl:openssl:1.0.1g:::::::*
cpe:2.3:a:openssl:openssl:1.0.2g:::::::*
cpe:2.3:a:openssl:openssl:1.0.1a:::::::*
cpe:2.3:a:openssl:openssl:1.0.2h:::::::*
cpe:2.3:a:openssl:openssl:1.0.1d:::::::*
cpe:2.3:a:openssl:openssl:1.0.1t:::::::*
cpe:2.3:a:openssl:openssl:1.0.2c:::::::*
cpe:2.3:a:openssl:openssl:1.0.1p:::::::*
cpe:2.3:a:openssl:openssl:1.0.1k:::::::*
cpe:2.3:a:openssl:openssl:1.0.1b:::::::*
cpe:2.3:a:openssl:openssl:1.0.1n:::::::*
cpe:2.3:a:openssl:openssl:1.0.1q:::::::*
cpe:2.3:a:openssl:openssl:1.0.1e:::::::*
cpe:2.3:a:openssl:openssl:1.0.1l:::::::*
cpe:2.3:a:openssl:openssl:1.0.1f:::::::*
cpe:2.3:a:openssl:openssl:1.0.1s:::::::*
cpe:2.3:a:openssl:openssl:1.0.1o:::::::*
cpe:2.3:a:openssl:openssl:1.0.2:::::::*
cpe:2.3:a:openssl:openssl:1.0.2f:::::::*
cpe:2.3:a:openssl:openssl:1.0.1i:::::::*
cpe:2.3:a:openssl:openssl:1.0.1:::::::*
cpe:2.3:a:openssl:openssl:1.0.2d:::::::*