#VU33337 Buffer overflow in OpenSSL - CVE-2009-1377

Vulnerability identifier: #VU33337

Vulnerability risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2009-1377

CWE-ID: CWE-119

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
OpenSSL
Server applications / Encryption software

Vendor: OpenSSL Software Foundation

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The dtls1_buffer_record function in ssl/d1_pkt.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allows remote attackers to cause a denial of service (memory consumption) via a large series of "future epoch" DTLS records that are buffered in a queue, aka "DTLS record buffer limitation bug."

Mitigation
Install update from vendor's website.

Vulnerable software versions

OpenSSL: 0.9.0b, 0.9.1c - 0.9.1b, 0.9.2b, 0.9.3a - 0.9.3, 0.9.4, 0.9.5a - 0.9.5, 0.9.6f - 0.9.6-15, 0.9.7m - 0.9.7, 0.9.8j - 0.9.8

---

External links
https:ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-009.txt.asc
https://cvs.openssl.org/chngview?cn=18187
https://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02029444
https://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html
https://lists.vmware.com/pipermail/security-announce/2010/000082.html
https://marc.info/?l=openssl-dev&m=124247675613888&w=2
https://rt.openssl.org/Ticket/Display.html?id=1930&user=guest&pass=guest
https://secunia.com/advisories/35128
https://secunia.com/advisories/35416
https://secunia.com/advisories/35461
https://secunia.com/advisories/35571
https://secunia.com/advisories/35729
https://secunia.com/advisories/36533
https://secunia.com/advisories/37003
https://secunia.com/advisories/38761
https://secunia.com/advisories/38794
https://secunia.com/advisories/38834
https://secunia.com/advisories/42724
https://secunia.com/advisories/42733
https://security.gentoo.org/glsa/glsa-200912-01.xml
https://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.663049
https://sourceforge.net/mailarchive/message.php?msg_name=4AD43807.7080105%40users.sourceforge.net
https://voodoo-circle.sourceforge.net/sa/sa-20091012-01.html
https://www.mandriva.com/security/advisories?name=MDVSA-2009:120
https://www.openwall.com/lists/oss-security/2009/05/18/1
https://www.redhat.com/support/errata/RHSA-2009-1335.html
https://www.securityfocus.com/bid/35001
https://www.securitytracker.com/id?1022241
https://www.ubuntu.com/usn/USN-792-1
https://www.vupen.com/english/advisories/2009/1377
https://www.vupen.com/english/advisories/2010/0528
https://kb.bluecoat.com/index?page=content&id=SA50
https://launchpad.net/bugs/cve/2009-1377
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6683
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9663

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.