CVE-2009-1378

Published: May 19, 2009Modified: Apr 23, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

Multiple memory leaks in the dtls1_process_out_of_seq_message function in ssl/d1_both.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allow remote attackers to cause a denial of service (memory consumption) via DTLS records that (1) are duplicates or (2) have sequence numbers much greater than current sequence numbers, aka "DTLS fragment handling memory leak."

Affected (5)

Products: Openssl: Openssl · Canonical: Ubuntu Linux

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	After 0.9.8 to 0.9.8m

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 6.06
Canonical Ubuntu Linux	Version 8.04
Canonical Ubuntu Linux	Version 8.10
Canonical Ubuntu Linux	Version 9.04

Related CWEs

CWE-401

Missing Release of Memory after Effective Lifetime

The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.

References (74)

ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-009.txt.asc (unsafe URL)

Source: secalert@redhat.com

Broken LinkThird Party Advisory

http://cvs.openssl.org/chngview?cn=18188

Source: secalert@redhat.com

Broken LinkPatchVendor Advisory

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02029444

Source: secalert@redhat.com

Broken LinkThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.vmware.com/pipermail/security-announce/2010/000082.html

Source: secalert@redhat.com

Third Party Advisory

http://marc.info/?l=openssl-dev&m=124247679213944&w=2

Source: secalert@redhat.com

Mailing ListPatchThird Party Advisory

http://marc.info/?l=openssl-dev&m=124263491424212&w=2

Source: secalert@redhat.com

ExploitMailing ListThird Party Advisory

http://rt.openssl.org/Ticket/Display.html?id=1931&user=guest&pass=guest

Source: secalert@redhat.com

Broken LinkThird Party Advisory

http://secunia.com/advisories/35128

Source: secalert@redhat.com

Not ApplicableThird Party Advisory

http://secunia.com/advisories/35416

Source: secalert@redhat.com

Not ApplicableThird Party Advisory

http://secunia.com/advisories/35461

Source: secalert@redhat.com

Not ApplicableThird Party Advisory

http://secunia.com/advisories/35571

Source: secalert@redhat.com

Not ApplicableThird Party Advisory

http://secunia.com/advisories/35729

Source: secalert@redhat.com

Not ApplicableThird Party Advisory

http://secunia.com/advisories/36533

Source: secalert@redhat.com

Not ApplicableThird Party Advisory

http://secunia.com/advisories/37003

Source: secalert@redhat.com

Not ApplicableThird Party Advisory

http://secunia.com/advisories/38761

Source: secalert@redhat.com

Not ApplicableThird Party Advisory

http://secunia.com/advisories/38794

Source: secalert@redhat.com

Not ApplicableThird Party Advisory

http://secunia.com/advisories/38834

Source: secalert@redhat.com

Not ApplicableThird Party Advisory

http://secunia.com/advisories/42724

Source: secalert@redhat.com

Not ApplicableThird Party Advisory

http://secunia.com/advisories/42733

Source: secalert@redhat.com

Not ApplicableThird Party Advisory

http://security.gentoo.org/glsa/glsa-200912-01.xml

Source: secalert@redhat.com

Third Party Advisory

http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.663049

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://sourceforge.net/mailarchive/message.php?msg_name=4AD43807.7080105%40users.sourceforge.net

Source: secalert@redhat.com

Broken Link

http://voodoo-circle.sourceforge.net/sa/sa-20091012-01.html

Source: secalert@redhat.com

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2009:120

Source: secalert@redhat.com

Not Applicable

http://www.openwall.com/lists/oss-security/2009/05/18/1

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.redhat.com/support/errata/RHSA-2009-1335.html

Source: secalert@redhat.com

Third Party Advisory

http://www.securityfocus.com/bid/35001

Source: secalert@redhat.com

Broken LinkThird Party AdvisoryVDB Entry

http://www.securitytracker.com/id?1022241

Source: secalert@redhat.com

Broken LinkThird Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-792-1

Source: secalert@redhat.com

Third Party Advisory

http://www.vupen.com/english/advisories/2009/1377

Source: secalert@redhat.com

Permissions RequiredThird Party Advisory

http://www.vupen.com/english/advisories/2010/0528

Source: secalert@redhat.com

Permissions RequiredThird Party Advisory

https://kb.bluecoat.com/index?page=content&id=SA50

Source: secalert@redhat.com

Broken Link

https://launchpad.net/bugs/cve/2009-1378

Source: secalert@redhat.com

Third Party Advisory

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11309

Source: secalert@redhat.com

Broken LinkTool Signature

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7229

Source: secalert@redhat.com

Broken LinkTool Signature

https://www.exploit-db.com/exploits/8720

Source: secalert@redhat.com

ExploitThird Party AdvisoryVDB Entry

ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-009.txt.asc (unsafe URL)