CVEvulnerability
CVE-2009-1378
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2009-05-19
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:N/A:P
- Weaknesses
- CWE-401
Description
Multiple memory leaks in the dtls1_process_out_of_seq_message function in ssl/d1_both.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allow remote attackers to cause a denial of service (memory consumption) via DTLS records that (1) are duplicates or (2) have sequence numbers much greater than current sequence numbers, aka "DTLS fragment handling memory leak."
Affected configurations
• openssl openssl (> 0.9.8 < 0.9.8m)
• canonical ubuntu linux 6.06
• canonical ubuntu linux 8.04
• canonical ubuntu linux 8.10
• canonical ubuntu linux 9.04
Related
Weakness · CWE (1)
- CWE-401 Missing Release of Memory after Effective Lifetime weakness
References
- ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-009.txt.asc Broken Link, Third Party Advisory
- http://cvs.openssl.org/chngview?cn=18188 Broken Link, Patch, Vendor Advisory
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02029444 Broken Link, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html Mailing List, Third Party Advisory
- http://lists.vmware.com/pipermail/security-announce/2010/000082.html Third Party Advisory
- http://marc.info/?l=openssl-dev&m=124247679213944&w=2 Mailing List, Patch, Third Party Advisory
- http://marc.info/?l=openssl-dev&m=124263491424212&w=2 Exploit, Mailing List, Third Party Advisory
- http://rt.openssl.org/Ticket/Display.html?id=1931&user=guest&pass=guest Broken Link, Third Party Advisory
- http://secunia.com/advisories/35128 Not Applicable, Third Party Advisory
- http://secunia.com/advisories/35416 Not Applicable, Third Party Advisory
- http://secunia.com/advisories/35461 Not Applicable, Third Party Advisory
- http://secunia.com/advisories/35571 Not Applicable, Third Party Advisory
- http://secunia.com/advisories/35729 Not Applicable, Third Party Advisory
- http://secunia.com/advisories/36533 Not Applicable, Third Party Advisory
- http://secunia.com/advisories/37003 Not Applicable, Third Party Advisory
- http://secunia.com/advisories/38761 Not Applicable, Third Party Advisory
- http://secunia.com/advisories/38794 Not Applicable, Third Party Advisory
- http://secunia.com/advisories/38834 Not Applicable, Third Party Advisory
- http://secunia.com/advisories/42724 Not Applicable, Third Party Advisory
- http://secunia.com/advisories/42733 Not Applicable, Third Party Advisory
- http://security.gentoo.org/glsa/glsa-200912-01.xml Third Party Advisory
- http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.663049 Mailing List, Third Party Advisory
- http://sourceforge.net/mailarchive/message.php?msg_name=4AD43807.7080105%40users.sourceforge.net Broken Link
- http://voodoo-circle.sourceforge.net/sa/sa-20091012-01.html Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:120 Not Applicable
- http://www.openwall.com/lists/oss-security/2009/05/18/1 Mailing List, Third Party Advisory
- http://www.redhat.com/support/errata/RHSA-2009-1335.html Third Party Advisory
- http://www.securityfocus.com/bid/35001 Broken Link, Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id?1022241 Broken Link, Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-792-1 Third Party Advisory
- http://www.vupen.com/english/advisories/2009/1377 Permissions Required, Third Party Advisory
- http://www.vupen.com/english/advisories/2010/0528 Permissions Required, Third Party Advisory
- https://kb.bluecoat.com/index?page=content&id=SA50 Broken Link
- https://launchpad.net/bugs/cve/2009-1378 Third Party Advisory
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11309 Broken Link, Tool Signature
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7229 Broken Link, Tool Signature
- https://www.exploit-db.com/exploits/8720 Exploit, Third Party Advisory, VDB Entry
- ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-009.txt.asc Broken Link, Third Party Advisory
- http://cvs.openssl.org/chngview?cn=18188 Broken Link, Patch, Vendor Advisory
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02029444 Broken Link, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html Mailing List, Third Party Advisory
- http://lists.vmware.com/pipermail/security-announce/2010/000082.html Third Party Advisory
- http://marc.info/?l=openssl-dev&m=124247679213944&w=2 Mailing List, Patch, Third Party Advisory
- http://marc.info/?l=openssl-dev&m=124263491424212&w=2 Exploit, Mailing List, Third Party Advisory
- http://rt.openssl.org/Ticket/Display.html?id=1931&user=guest&pass=guest Broken Link, Third Party Advisory
- http://secunia.com/advisories/35128 Not Applicable, Third Party Advisory
- http://secunia.com/advisories/35416 Not Applicable, Third Party Advisory
- http://secunia.com/advisories/35461 Not Applicable, Third Party Advisory
- http://secunia.com/advisories/35571 Not Applicable, Third Party Advisory
- http://secunia.com/advisories/35729 Not Applicable, Third Party Advisory
- http://secunia.com/advisories/36533 Not Applicable, Third Party Advisory
- http://secunia.com/advisories/37003 Not Applicable, Third Party Advisory
- http://secunia.com/advisories/38761 Not Applicable, Third Party Advisory
- http://secunia.com/advisories/38794 Not Applicable, Third Party Advisory
- http://secunia.com/advisories/38834 Not Applicable, Third Party Advisory
- http://secunia.com/advisories/42724 Not Applicable, Third Party Advisory
- http://secunia.com/advisories/42733 Not Applicable, Third Party Advisory
- http://security.gentoo.org/glsa/glsa-200912-01.xml Third Party Advisory
- http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.663049 Mailing List, Third Party Advisory
- http://sourceforge.net/mailarchive/message.php?msg_name=4AD43807.7080105%40users.sourceforge.net Broken Link
- http://voodoo-circle.sourceforge.net/sa/sa-20091012-01.html Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:120 Not Applicable
- http://www.openwall.com/lists/oss-security/2009/05/18/1 Mailing List, Third Party Advisory
- http://www.redhat.com/support/errata/RHSA-2009-1335.html Third Party Advisory
- http://www.securityfocus.com/bid/35001 Broken Link, Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id?1022241 Broken Link, Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-792-1 Third Party Advisory
- http://www.vupen.com/english/advisories/2009/1377 Permissions Required, Third Party Advisory
- http://www.vupen.com/english/advisories/2010/0528 Permissions Required, Third Party Advisory
- https://kb.bluecoat.com/index?page=content&id=SA50 Broken Link
- https://launchpad.net/bugs/cve/2009-1378 Third Party Advisory
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11309 Broken Link, Tool Signature
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7229 Broken Link, Tool Signature
- https://www.exploit-db.com/exploits/8720 Exploit, Third Party Advisory, VDB Entry