CVE-2009-1377

Published: May 19, 2009Modified: Apr 23, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

The dtls1_buffer_record function in ssl/d1_pkt.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allows remote attackers to cause a denial of service (memory consumption) via a large series of "future epoch" DTLS records that are buffered in a queue, aka "DTLS record buffer limitation bug."

Affected (1)

Products: Openssl: Openssl

Openssl

1 product

Openssl

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	From 0.9.8 to 0.9.8m

Related CWEs

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (70)

ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-009.txt.asc (unsafe URL)

Source: secalert@redhat.com

Broken LinkThird Party Advisory

http://cvs.openssl.org/chngview?cn=18187

Source: secalert@redhat.com

Broken LinkPatchThird Party Advisory

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02029444

Source: secalert@redhat.com

Broken LinkThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html

Source: secalert@redhat.com

Third Party Advisory

http://lists.vmware.com/pipermail/security-announce/2010/000082.html

Source: secalert@redhat.com

Third Party Advisory

http://marc.info/?l=openssl-dev&m=124247675613888&w=2

Source: secalert@redhat.com

Mailing ListPatchThird Party Advisory

http://rt.openssl.org/Ticket/Display.html?id=1930&user=guest&pass=guest

Source: secalert@redhat.com

Broken LinkMailing ListPatchThird Party Advisory

http://secunia.com/advisories/35128

Source: secalert@redhat.com

Third Party AdvisoryVendor Advisory

http://secunia.com/advisories/35416

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/35461

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/35571

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/35729

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/36533

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/37003

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/38761

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/38794

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/38834

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/42724

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/42733

Source: secalert@redhat.com

Third Party Advisory

http://security.gentoo.org/glsa/glsa-200912-01.xml

Source: secalert@redhat.com

Third Party Advisory

http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.663049

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://sourceforge.net/mailarchive/message.php?msg_name=4AD43807.7080105%40users.sourceforge.net

Source: secalert@redhat.com

Broken Link

http://voodoo-circle.sourceforge.net/sa/sa-20091012-01.html

Source: secalert@redhat.com

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2009:120

Source: secalert@redhat.com

Broken Link

http://www.openwall.com/lists/oss-security/2009/05/18/1

Source: secalert@redhat.com

Mailing List

http://www.redhat.com/support/errata/RHSA-2009-1335.html

Source: secalert@redhat.com

Third Party Advisory

http://www.securityfocus.com/bid/35001

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id?1022241

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-792-1

Source: secalert@redhat.com

Third Party Advisory

http://www.vupen.com/english/advisories/2009/1377

Source: secalert@redhat.com

Permissions RequiredThird Party Advisory

http://www.vupen.com/english/advisories/2010/0528

Source: secalert@redhat.com

Permissions RequiredThird Party Advisory

https://kb.bluecoat.com/index?page=content&id=SA50

Source: secalert@redhat.com

Broken Link

https://launchpad.net/bugs/cve/2009-1377

Source: secalert@redhat.com

Third Party Advisory

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6683

Source: secalert@redhat.com

Tool Signature

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9663

Source: secalert@redhat.com

Tool Signature

ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-009.txt.asc (unsafe URL)