#VU33338 Resource management error in OpenSSL - CVE-2009-1378

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU33338

#VU33338 Resource management error in OpenSSL - CVE-2009-1378

Published: May 19, 2009 / Updated: August 3, 2020


Vulnerability identifier: #VU33338
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2009-1378
CWE-ID: CWE-399
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
OpenSSL
Software vendor:
OpenSSL Software Foundation

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

Multiple memory leaks in the dtls1_process_out_of_seq_message function in ssl/d1_both.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allow remote attackers to cause a denial of service (memory consumption) via DTLS records that (1) are duplicates or (2) have sequence numbers much greater than current sequence numbers, aka "DTLS fragment handling memory leak."


Remediation

Install update from vendor's website.

External links