Published: 29/05/2008 Updated: 07/11/2023

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P

Double free vulnerability in OpenSSL 0.9.8f and 0.9.8g, when the TLS server name extensions are enabled, allows remote malicious users to cause a denial of service (crash) via a malformed Client Hello packet. NOTE: some of these details are obtained from third party information.

Vulnerable Product	Search on Vulmon	Subscribe to Product
openssl openssl 0.9.8g
openssl openssl 0.9.8f

It was discovered that OpenSSL was vulnerable to a double-free when using TLS server extensions A remote attacker could send a crafted packet and cause a denial of service via application crash in applications linked against OpenSSL Ubuntu 804 LTS does not compile TLS server extensions by default (CVE-2008-0891) ...

Debian Bug report logs - #483379 openssl: CVE-2008-1672, CVE-2008-0891 multiple security issues Package: openssl; Maintainer for openssl is Debian OpenSSL Team <pkg-openssl-devel@listsaliothdebianorg>; Source for openssl is src:openssl (PTS, buildd, popcon) Reported by: Nico Golde <nion@debianorg> Date: Wed, 28 M ...

CWE-189 http://www.openssl.org/news/secadv_20080528.txt http://www.securityfocus.com/bid/29405 http://secunia.com/advisories/30405 http://www.kb.cert.org/vuls/id/661475 http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.562004 http://secunia.com/advisories/30825 http://secunia.com/advisories/31288 http://secunia.com/advisories/31228 http://sourceforge.net/project/shownotes.php?release_id=615606 http://security.gentoo.org/glsa/glsa-200806-08.xml http://www.ubuntu.com/usn/usn-620-1 http://secunia.com/advisories/30868 https://www.redhat.com/archives/fedora-package-announce/2008-May/msg01029.html http://secunia.com/advisories/30460 http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=738400 http://secunia.com/advisories/30852 http://www.vupen.com/english/advisories/2008/1937/references http://www.securitytracker.com/id?1020121 http://www.mandriva.com/security/advisories?name=MDVSA-2008:107 http://cert.fi/haavoittuvuudet/2008/advisory-openssl.html http://www.vupen.com/english/advisories/2008/1680 https://exchange.xforce.ibmcloud.com/vulnerabilities/42666 https://nvd.nist.gov https://usn.ubuntu.com/620-1/https://www.kb.cert.org/vuls/id/661475

CVE-2008-0891

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect