5

CVE-2009-1378

Exploit

Multiple memory leaks in the dtls1_process_out_of_seq_message function in ssl/d1_both.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allow remote attackers to cause a denial of service (memory consumption) via DTLS records that (1) are duplicates or (2) have sequence numbers much greater than current sequence numbers, aka "DTLS fragment handling memory leak."

Data is provided by the National Vulnerability Database (NVD)
OpenSSL ≫ OpenSSL Version > 0.9.8 < 0.9.8m
Canonical ≫ Ubuntu Linux Version6.06
Canonical ≫ Ubuntu Linux Version8.04 SwEdition-
Canonical ≫ Ubuntu Linux Version8.10
Canonical ≫ Ubuntu Linux Version9.04
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 15.69% 0.945
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:N/A:P
CWE-401 Missing Release of Memory after Effective Lifetime

The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.

http://secunia.com/advisories/38761
Third Party Advisory
Not Applicable
http://secunia.com/advisories/42724
Third Party Advisory
Not Applicable
http://secunia.com/advisories/42733
Third Party Advisory
Not Applicable
http://secunia.com/advisories/35416
Third Party Advisory
Not Applicable
http://secunia.com/advisories/38794
Third Party Advisory
Not Applicable
http://www.vupen.com/english/advisories/2010/0528
Third Party Advisory
Permissions Required
http://secunia.com/advisories/35729
Third Party Advisory
Not Applicable
http://secunia.com/advisories/36533
Third Party Advisory
Not Applicable
http://secunia.com/advisories/38834
Third Party Advisory
Not Applicable
http://secunia.com/advisories/35128
Third Party Advisory
Not Applicable
http://secunia.com/advisories/35461
Third Party Advisory
Not Applicable
http://secunia.com/advisories/35571
Third Party Advisory
Not Applicable
http://secunia.com/advisories/37003
Third Party Advisory
Not Applicable
http://www.securityfocus.com/bid/35001
Third Party Advisory
Broken Link
VDB Entry
http://www.securitytracker.com/id?1022241
Third Party Advisory
Broken Link
VDB Entry
http://www.vupen.com/english/advisories/2009/1377
Third Party Advisory
Permissions Required
http://cvs.openssl.org/chngview?cn=18188
Patch
Vendor Advisory
Broken Link
http://marc.info/?l=openssl-dev&m=124247679213944&w=2
Patch
Third Party Advisory
Mailing List
http://marc.info/?l=openssl-dev&m=124263491424212&w=2
Third Party Advisory
Exploit
Mailing List
https://www.exploit-db.com/exploits/8720
Third Party Advisory
Exploit
VDB Entry