PT-2008-3226 · Openssl+2 · Openssl+2

Michael Chen · Publicado 2008-07-10 · Atualizado 2024-06-15 · CVE-2008-1678

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions OpenSSL versions 0.9.8f through 0.9.8h

Description A memory leak in the zlib stateful init function in libssl allows remote attackers to cause a denial of service via multiple calls, such as initial SSL client handshakes to the Apache HTTP Server mod ssl that specify a compression algorithm.

Recommendations For versions 0.9.8f through 0.9.8h, consider updating to a version that fixes the memory leak issue in the zlib stateful init function to prevent denial of service attacks.

Exploit

Correção

DoS

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2008-1678

DTSA-131-1

OPENSUSE-SU-2024:10623-1

RHSA-2009:1075

RHSA-2009_1075

Produtos afetados

Apache Http Server

Openssl

Red Hat

Referências · 70

• 🔥 https://bugs.edge.launchpad.net/bugs/224945 · Exploit
• 🔥 http://marc.info/?l=openssl-dev&m=121060672602371&w=2 · Exploit
• http://secunia.com/advisories/32222 · Nota
• http://svn.apache.org/viewvc?view=rev&revision=654119 · Nota
• https://suse.com/security/cve/CVE-2007-6421 · Nota
• https://suse.com/security/cve/CVE-2006-5752 · Nota
• https://suse.com/security/cve/CVE-2008-0005 · Nota
• https://kb.bluecoat.com/index?page=content&id=SA50 · Nota
• http://security.gentoo.org/glsa/glsa-200807-06.xml · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2019-10097 · Nota
• https://access.redhat.com/errata/RHSA-2009:1075 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=447268 · Nota
• http://vupen.com/english/advisories/2008/2780 · Nota
• http://secunia.com/advisories/31026 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2007-6388 · Nota