Multiple memory leaks in the dtls1_process_out_of_seq_message function in ssl/d1_both.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allow remote attackers to cause a denial of service (memory consumption) via DTLS records that (1) are duplicates or (2) have sequence numbers much greater than current sequence numbers, aka "DTLS fragment handling memory leak."
References
Configurations
History
21 Nov 2024, 01:02
| Type | Values Removed | Values Added |
|---|---|---|
| References | () ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-009.txt.asc - Broken Link, Third Party Advisory | |
| References | () http://cvs.openssl.org/chngview?cn=18188 - Broken Link, Patch, Vendor Advisory | |
| References | () http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02029444 - Broken Link, Third Party Advisory | |
| References | () http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html - Mailing List, Third Party Advisory | |
| References | () http://lists.vmware.com/pipermail/security-announce/2010/000082.html - Third Party Advisory | |
| References | () http://marc.info/?l=openssl-dev&m=124247679213944&w=2 - Mailing List, Patch, Third Party Advisory | |
| References | () http://marc.info/?l=openssl-dev&m=124263491424212&w=2 - Exploit, Mailing List, Third Party Advisory | |
| References | () http://rt.openssl.org/Ticket/Display.html?id=1931&user=guest&pass=guest - Broken Link, Third Party Advisory | |
| References | () http://secunia.com/advisories/35128 - Not Applicable, Third Party Advisory | |
| References | () http://secunia.com/advisories/35416 - Not Applicable, Third Party Advisory | |
| References | () http://secunia.com/advisories/35461 - Not Applicable, Third Party Advisory | |
| References | () http://secunia.com/advisories/35571 - Not Applicable, Third Party Advisory | |
| References | () http://secunia.com/advisories/35729 - Not Applicable, Third Party Advisory | |
| References | () http://secunia.com/advisories/36533 - Not Applicable, Third Party Advisory | |
| References | () http://secunia.com/advisories/37003 - Not Applicable, Third Party Advisory | |
| References | () http://secunia.com/advisories/38761 - Not Applicable, Third Party Advisory | |
| References | () http://secunia.com/advisories/38794 - Not Applicable, Third Party Advisory | |
| References | () http://secunia.com/advisories/38834 - Not Applicable, Third Party Advisory | |
| References | () http://secunia.com/advisories/42724 - Not Applicable, Third Party Advisory | |
| References | () http://secunia.com/advisories/42733 - Not Applicable, Third Party Advisory | |
| References | () http://security.gentoo.org/glsa/glsa-200912-01.xml - Third Party Advisory | |
| References | () http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.663049 - Mailing List, Third Party Advisory | |
| References | () http://sourceforge.net/mailarchive/message.php?msg_name=4AD43807.7080105%40users.sourceforge.net - Broken Link | |
| References | () http://voodoo-circle.sourceforge.net/sa/sa-20091012-01.html - Third Party Advisory | |
| References | () http://www.mandriva.com/security/advisories?name=MDVSA-2009:120 - Not Applicable | |
| References | () http://www.openwall.com/lists/oss-security/2009/05/18/1 - Mailing List, Third Party Advisory | |
| References | () http://www.redhat.com/support/errata/RHSA-2009-1335.html - Third Party Advisory | |
| References | () http://www.securityfocus.com/bid/35001 - Broken Link, Third Party Advisory, VDB Entry | |
| References | () http://www.securitytracker.com/id?1022241 - Broken Link, Third Party Advisory, VDB Entry | |
| References | () http://www.ubuntu.com/usn/USN-792-1 - Third Party Advisory | |
| References | () http://www.vupen.com/english/advisories/2009/1377 - Permissions Required, Third Party Advisory | |
| References | () http://www.vupen.com/english/advisories/2010/0528 - Permissions Required, Third Party Advisory | |
| References | () https://kb.bluecoat.com/index?page=content&id=SA50 - Broken Link | |
| References | () https://launchpad.net/bugs/cve/2009-1378 - Third Party Advisory | |
| References | () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11309 - Broken Link, Tool Signature | |
| References | () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7229 - Broken Link, Tool Signature | |
| References | () https://www.exploit-db.com/exploits/8720 - Exploit, Third Party Advisory, VDB Entry |
07 Feb 2024, 18:02
| Type | Values Removed | Values Added |
|---|---|---|
| References | (SECUNIA) http://secunia.com/advisories/35729 - Not Applicable, Third Party Advisory | |
| References | (SECUNIA) http://secunia.com/advisories/36533 - Not Applicable, Third Party Advisory | |
| References | (MANDRIVA) http://www.mandriva.com/security/advisories?name=MDVSA-2009:120 - Not Applicable | |
| References | (SECUNIA) http://secunia.com/advisories/38761 - Not Applicable, Third Party Advisory | |
| References | (SECUNIA) http://secunia.com/advisories/38794 - Not Applicable, Third Party Advisory | |
| References | (SECUNIA) http://secunia.com/advisories/35128 - Not Applicable, Third Party Advisory | |
| References | (SECUNIA) http://secunia.com/advisories/38834 - Not Applicable, Third Party Advisory | |
| References | (OVAL) https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7229 - Broken Link, Tool Signature | |
| References | (SECUNIA) http://secunia.com/advisories/35461 - Not Applicable, Third Party Advisory | |
| References | (SECUNIA) http://secunia.com/advisories/42724 - Not Applicable, Third Party Advisory | |
| References | (SECUNIA) http://secunia.com/advisories/42733 - Not Applicable, Third Party Advisory | |
| References | (OVAL) https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11309 - Broken Link, Tool Signature | |
| References | (SECUNIA) http://secunia.com/advisories/37003 - Not Applicable, Third Party Advisory | |
| References | (SECUNIA) http://secunia.com/advisories/35416 - Not Applicable, Third Party Advisory | |
| References | (SECUNIA) http://secunia.com/advisories/35571 - Not Applicable, Third Party Advisory | |
| CPE | cpe:2.3:a:openssl:openssl:0.9.8i:*:*:*:*:*:*:* cpe:2.3:a:openssl:openssl:0.9.8:beta2:*:*:*:*:*:* cpe:2.3:a:openssl:openssl:0.9.8a:*:*:*:*:*:*:* cpe:2.3:a:openssl:openssl:0.9.8d:*:*:*:*:*:*:* cpe:2.3:a:openssl:openssl:0.9.8:beta4:*:*:*:*:*:* cpe:2.3:a:openssl:openssl:0.9.8:beta6:*:*:*:*:*:* cpe:2.3:a:openssl:openssl:0.9.8f:*:*:*:*:*:*:* cpe:2.3:a:openssl:openssl:0.9.8b:*:*:*:*:*:*:* cpe:2.3:a:openssl:openssl:0.9.8h:*:*:*:*:*:*:* cpe:2.3:a:openssl:openssl:0.9.8:beta1:*:*:*:*:*:* cpe:2.3:a:openssl:openssl:0.9.8:beta3:*:*:*:*:*:* cpe:2.3:a:openssl:openssl:0.9.8g:*:*:*:*:*:*:* cpe:2.3:a:openssl:openssl:0.9.8c:*:*:*:*:*:*:* cpe:2.3:a:openssl:openssl:0.9.8:-:*:*:*:*:*:* cpe:2.3:a:openssl:openssl:0.9.8:beta5:*:*:*:*:*:* cpe:2.3:a:openssl:openssl:0.9.8j:*:*:*:*:*:*:* cpe:2.3:a:openssl:openssl:0.9.8e:*:*:*:*:*:*:* |
Information
Published : 2009-05-19 19:30
Updated : 2024-11-21 01:02
NVD link : CVE-2009-1378
Mitre link : CVE-2009-1378
CVE.ORG link : CVE-2009-1378
JSON object : View
Products Affected
canonical
- ubuntu_linux
openssl
- openssl
CWE
CWE-401
Missing Release of Memory after Effective Lifetime