CVE-2009-1387

Published Jun 4, 2009

Last updated 9 months ago

Overview

Description: The dtls1_retrieve_buffered_fragment function in ssl/d1_both.c in OpenSSL before 1.0.0 Beta 2 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence DTLS handshake message, related to a "fragment bug."
Source: secalert@redhat.com
NVD status: Analyzed

Hype score: Not currently trending

Risk scores

CVSS 2.0

Type: Primary
Base score: 5
Impact score: 2.9
Exploitability score: 10
Vector string: AV:N/AC:L/Au:N/C:N/I:N/A:P

Weaknesses

nvd@nist.gov: CWE-476

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "EA054F35-6E05-4A24-9195-F80C0C2761DC",
            "versionEndExcluding": "0.9.8m",
            "versionStartIncluding": "0.9.8"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:redhat:openssl:0.9.6-15:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2B8C80A1-D1E7-42D4-8DBC-CB7637D7598E"
          },
          {
            "criteria": "cpe:2.3:a:redhat:openssl:0.9.6b-3:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3EB3990A-3457-4CD6-9EEC-F2D4BC143932"
          },
          {
            "criteria": "cpe:2.3:a:redhat:openssl:0.9.7a-2:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "06110A61-8857-46D5-BEE1-882197756DED"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "454A5D17-B171-4F1F-9E0B-F18D1E5CA9FD"
          },
          {
            "criteria": "cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7EBFE35C-E243-43D1-883D-4398D71763CC"
          },
          {
            "criteria": "cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "4747CC68-FAF4-482F-929A-9DA6C24CB663"
          },
          {
            "criteria": "cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A5D026D0-EF78-438D-BEDD-FC8571F3ACEB"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 2.0

Weaknesses

Configurations

References