Resource management error in OpenSSL - CVE-2009-1378

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU33338

Resource management error in OpenSSL - CVE-2009-1378

Published: May 19, 2009 / Updated: August 3, 2020


Vulnerability identifier: #VU33338
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2009-1378
CWE-ID: CWE-399
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

Multiple memory leaks in the dtls1_process_out_of_seq_message function in ssl/d1_both.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allow remote attackers to cause a denial of service (memory consumption) via DTLS records that (1) are duplicates or (2) have sequence numbers much greater than current sequence numbers, aka "DTLS fragment handling memory leak."


Affected software

OpenSSL
openssl (Alpine package)

How to mitigate CVE-2009-1378

Install update from vendor's website.

OpenSSL - update to 0.9.8l
openssl (Alpine package) - addressed in versions 0.9.8m-r0, 0.9.8l-r1

External References

Related Security Bulletins