Resource management error in OpenSSL - CVE-2009-1378

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU33338

Resource management error in OpenSSL - CVE-2009-1378

Published: May 19, 2009 / Updated: August 3, 2020


Vulnerability identifier: #VU33338
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2009-1378
CWE-ID: CWE-399
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vendor: OpenSSL Software Foundation
Affected software:
OpenSSL

Detailed vulnerability description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

Multiple memory leaks in the dtls1_process_out_of_seq_message function in ssl/d1_both.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allow remote attackers to cause a denial of service (memory consumption) via DTLS records that (1) are duplicates or (2) have sequence numbers much greater than current sequence numbers, aka "DTLS fragment handling memory leak."


How to mitigate CVE-2009-1378

Install update from vendor's website.

Sources