OpenSSL DTLS Processing Bugs Let Users Deny Service
|
|
SecurityTracker Alert ID: 1022241
|
|
SecurityTracker URL: http://securitytracker.com/id?1022241
|
|
CVE Reference: CVE-2009-1377
, CVE-2009-1378
, CVE-2009-1379
, CVE-2009-1386
, CVE-2009-1387
(Links to External Site)
|
Updated: Jun 26 2009
|
Original Entry Date: May 18 2009
|
Impact: Denial of service via local system, Denial of service via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): 1.0.0 and prior versions
|
Description: Several vulnerabilities were reported in OpenSSL. A user can cause denial of service conditions.
A user can send specially crafted DTLS records with a future epoch to consume excessive memory on the target system.
A user can
send specially crafted DTLS messages to trigger a memory leak and consume excessive memory on the target system.
A user can send
DTLS data with a specially crafted certificate to cause freed memory to be used by the dtls1_retrieve_buffered_fragment() function
in 'ssl/d1_both.c'. OpenSSL 1.0.0 Beta 2 is affected.
Daniel Mentz reported the above listed vulnerabilities.
A remote user
can send a DTLS ChangeCipherSpec packet prior to a ClientHello packet to trigger a null pointer dereference in 'ssl/s3_pkt.c' and
cause the target daemon to crash.
A remote user can send an out-of-sequence DTLS handshake message to trigger a null pointer
dereference in the dtls1_retrieve_buffered_fragment() function in 'ssl/d1_both.c' and cause the target daemon to crash.
|
Impact: A user can consume excessive memory on the target system.
A user can cause an affected application to crash.
|
Solution: The vendor has issued a source code fix.
|
Vendor URL: www.openssl.org/ (Links to External Site)
|
Cause: Access control error, Resource error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Mon, 18 May 2009 07:43:03 -0400
Subject: OpenSSL
|
http://rt.openssl.org/Ticket/Display.html?id=1930
http://rt.openssl.org/Ticket/Display.html?id=1931
|
|
