PT-2009-1099 · Openssl+1 · Openssl+1
Mark J Cox
·
Published
2009-05-19
·
Updated
2024-06-15
·
CVE-2009-1377
CVSS v2.0
5.8
Medium
| Vector | AV:N/AC:M/Au:N/C:N/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
OpenSSL versions prior to 0.9.8l
Description
The issue allows remote attackers to cause a denial of service, affecting the integrity and availability of protected information. This can be achieved through the exploitation of the dtls1 buffer record function in ssl/d1 pkt.c, which is vulnerable to a large series of "future epoch" DTLS records that are buffered in a queue, also known as the "DTLS record buffer limitation bug."
Recommendations
For versions prior to 0.9.8l, update to version 0.9.8l or later to resolve the issue.
As a temporary workaround, consider restricting access to the dtls1 buffer record function in ssl/d1 pkt.c to minimize the risk of exploitation.
Fix
DoS
Improper Certificate Validation
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Openssl
Red Hat