SB2009051902 - Resource management error in OpenSSL

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2009051902

SB2009051902 - Resource management error in OpenSSL

Published: May 19, 2009 Updated: August 3, 2020

Security Bulletin ID SB2009051902
Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Resource management error (CVE-ID: CVE-2009-1378)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

Multiple memory leaks in the dtls1_process_out_of_seq_message function in ssl/d1_both.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allow remote attackers to cause a denial of service (memory consumption) via DTLS records that (1) are duplicates or (2) have sequence numbers much greater than current sequence numbers, aka "DTLS fragment handling memory leak."


Remediation

Install update from vendor's website.

References