CVE-2009-3245

Published: Mar 5, 2010Modified: Apr 29, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

OpenSSL before 0.9.8m does not check for a NULL return value from bn_wexpand function calls in (1) crypto/bn/bn_div.c, (2) crypto/bn/bn_gf2m.c, (3) crypto/ec/ec2_smpl.c, and (4) engines/e_ubsec.c, which has unspecified impact and context-dependent attack vectors.

Affected (13)

Products: Openssl: Openssl

Openssl

1 product

Openssl

Configuration A

13 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	version ≤ 0.9.8l
Openssl Openssl	Version 0.9.8
Openssl Openssl	Version 0.9.8a
Openssl Openssl	Version 0.9.8b
Openssl Openssl	Version 0.9.8c
Openssl Openssl	Version 0.9.8d
Openssl Openssl	Version 0.9.8e
Openssl Openssl	Version 0.9.8f
Openssl Openssl	Version 0.9.8g
Openssl Openssl	Version 0.9.8h
Openssl Openssl	Version 0.9.8i
Openssl Openssl	Version 0.9.8j
Openssl Openssl	Version 0.9.8k

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (68)

http://aix.software.ibm.com/aix/efixes/security/openssl_advisory.asc

Source: cve@mitre.org

http://lists.apple.com/archives/security-announce/2011//Jun/msg00000.html

Source: cve@mitre.org

http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038587.html

Source: cve@mitre.org

http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039561.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=127128920008563&w=2

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=127678688104458&w=2

Source: cve@mitre.org

http://marc.info/?l=openssl-cvs&m=126692159706582&w=2

Source: cve@mitre.org

Patch

http://marc.info/?l=openssl-cvs&m=126692170906712&w=2

Source: cve@mitre.org

Patch

http://marc.info/?l=openssl-cvs&m=126692180606861&w=2

Source: cve@mitre.org

Patch

http://packetstormsecurity.com/files/153392/ABB-HMI-Outdated-Software-Components.html

Source: cve@mitre.org

http://secunia.com/advisories/37291

Source: cve@mitre.org

http://secunia.com/advisories/38761

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/39461

Source: cve@mitre.org

http://secunia.com/advisories/39932

Source: cve@mitre.org

http://secunia.com/advisories/42724

Source: cve@mitre.org

http://secunia.com/advisories/42733

Source: cve@mitre.org

http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.663049

Source: cve@mitre.org

http://support.apple.com/kb/HT4723

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDVSA-2010:076

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2010-0977.html

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2011-0896.html

Source: cve@mitre.org

http://www.securityfocus.com/bid/38562

Source: cve@mitre.org

http://www.ubuntu.com/usn/USN-1003-1

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2010/0839

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2010/0916

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2010/0933

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2010/1216

Source: cve@mitre.org

https://kb.bluecoat.com/index?page=content&id=SA50

Source: cve@mitre.org

https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000101.html

Source: cve@mitre.org

https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000102.html

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11738

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6640

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9790

Source: cve@mitre.org

http://aix.software.ibm.com/aix/efixes/security/openssl_advisory.asc