CVE-2009-1379

Openssl - Resource Management Error

Title source: rule

Description

Use-after-free vulnerability in the dtls1_retrieve_buffered_fragment function in ssl/d1_both.c in OpenSSL 1.0.0 Beta 2 allows remote attackers to cause a denial of service (openssl s_client crash) and possibly have unspecified other impact via a DTLS packet, as demonstrated by a packet from a server that uses a crafted server certificate.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Jon Oberheide · cdosmultiple

https://www.exploit-db.com/exploits/8720

View Code ZIP pw:eip

References (32)

[Vendor Advisory] http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02029444

[Mailing List] http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html

[Various Sources] http://lists.vmware.com/pipermail/security-announce/2010/000082.html

[Exploit] http://rt.openssl.org/Ticket/Display.html?id=1923&user=guest&pass=guest

[Vendor Advisory] http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.663049

[Product] http://sourceforge.net/mailarchive/message.php?msg_name=4AD43807.7080105%40users.sourceforge.net

[Product] http://voodoo-circle.sourceforge.net/sa/sa-20091012-01.html

[Vendor Advisory] http://www.redhat.com/support/errata/RHSA-2009-1335.html

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/35138

[Vendor Advisory] http://www.ubuntu.com/usn/USN-792-1

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/50661

[Various Sources] https://kb.bluecoat.com/index?page=content&id=SA50

[Various Sources] https://launchpad.net/bugs/cve/2009-1379

[Third Party Advisory, VDB Entry] https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6848

[Third Party Advisory, VDB Entry] https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9744

[Vendor Advisory] ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-009.txt.asc

[Third Party Advisory] http://security.gentoo.org/glsa/glsa-200912-01.xml

[Mailing List] http://www.openwall.com/lists/oss-security/2009/05/18/4

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id?1022241

[Third Party Advisory] http://secunia.com/advisories/35416

... and 12 more

Scores

EPSS 0.0856

EPSS Percentile 92.4%

Details

CWE

CWE-399

Status published

Products (1)

openssl/openssl 1.0.0 beta2

Published May 19, 2009

Tracked Since Feb 18, 2026