Published: 04/06/2009 Updated: 07/02/2024

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 505

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

ssl/s3_pkt.c in OpenSSL prior to 0.9.8i allows remote malicious users to cause a denial of service (NULL pointer dereference and daemon crash) via a DTLS ChangeCipherSpec packet that occurs before ClientHello.

Vulnerable Product	Search on Vulmon	Subscribe to Product
openssl openssl
redhat openssl 0.9.6-15
redhat openssl 0.9.6b-3
redhat openssl 0.9.7a-2
canonical ubuntu linux 9.04
canonical ubuntu linux 8.10
canonical ubuntu linux 8.04
canonical ubuntu linux 6.06

Debian Bug report logs - #532037 CVE-2009-138{6,7}: Two OpenSSL DTLS remote DoS Package: openssl; Maintainer for openssl is Debian OpenSSL Team <pkg-openssl-devel@listsaliothdebianorg>; Source for openssl is src:openssl (PTS, buildd, popcon) Reported by: Giuseppe Iuculano <giuseppe@iuculanoit> Date: Fri, 5 Jun 2 ...

It was discovered that OpenSSL did not limit the number of DTLS records it would buffer when they arrived with a future epoch A remote attacker could cause a denial of service via memory resource consumption by sending a large number of crafted requests (CVE-2009-1377) ...

/* * cve-2009-1386c * * OpenSSL < 098i DTLS ChangeCipherSpec Remote DoS * Jon Oberheide <jon@oberheideorg> * jonoberheideorg * * Information: * * cvemitreorg/cgi-bin/cvenamecgi?name=CVE-2009-1386 * * OpenSSL would SegFault if the DTLS server receives a ChangeCipherSpec as * the first record instead ...

OpenSSL versions below 098i DTLS ChangeCipherSpec remote denial of service exploit ...

CWE-476 http://www.securityfocus.com/bid/35174 http://cvs.openssl.org/chngview?cn=17369 http://rt.openssl.org/Ticket/Display.html?id=1679&user=guest&pass=guest http://www.openwall.com/lists/oss-security/2009/06/02/1 http://www.ubuntu.com/usn/USN-792-1 http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html http://secunia.com/advisories/35571 ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-009.txt.asc http://secunia.com/advisories/35685 http://secunia.com/advisories/35729 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02029444 http://secunia.com/advisories/38794 http://lists.vmware.com/pipermail/security-announce/2010/000082.html http://www.vupen.com/english/advisories/2010/0528 http://secunia.com/advisories/38834 http://secunia.com/advisories/36533 http://www.redhat.com/support/errata/RHSA-2009-1335.html https://exchange.xforce.ibmcloud.com/vulnerabilities/50963 https://www.exploit-db.com/exploits/8873 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7469 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11179 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=532037 https://usn.ubuntu.com/792-1/https://nvd.nist.gov https://www.exploit-db.com/exploits/8873/

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2009-1386

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect