PT-2009-6752 · Openssl+1 · Openssl+1

Published 1970-01-01 · Updated 2024-06-15 · CVE-2009-0789

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenSSL versions prior to 0.9.8k

Description The issue is related to the improper handling of a malformed ASN.1 structure in OpenSSL, which can be exploited remotely. This can lead to a denial of service, causing invalid memory access and application crash, by placing the malformed structure in the public key of a certificate, such as an RSA public key.

Recommendations For versions prior to 0.9.8k, update to version 0.9.8k or later to resolve the issue. As a temporary workaround, consider restricting access to certificates with potentially malformed ASN.1 structures until a patch is available.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

CWE-189

Related Identifiers

BDU:2015-05174

BDU:2015-05175

CVE-2009-0789

HPSBUX02435

OPENSUSE-SU-2024:11127-1

Affected Products

Hp-Ux

Openssl

References · 177

• http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html · Vendor Advisory
• http://secunia.com/advisories/36701 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11127-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-05175 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0590 · Security Note
• http://secunia.com/advisories/42724 · Vendor Advisory
• http://vupen.com/english/advisories/2009/1020 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09382 · Security Note
• http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00013.html · Vendor Advisory
• http://vupen.com/english/advisories/2009/1548 · Vendor Advisory
• ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-008.txt.asc · Vendor Advisory
• http://secunia.com/advisories/34411 · Vendor Advisory
• http://openssl.org/news/secadv_20090325.txt · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-05174 · Security Note