CVE-2009-1377 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Openssl

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer8 documents8 sources
Severity
5.0MEDIUMNVD
EPSS
2.9%
top 13.68%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
OpensslDebian Openssl
Timeline
PublishedMay 19
Latest updateDec 29

Description

The dtls1_buffer_record function in ssl/d1_pkt.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allows remote attackers to cause a denial of service (memory consumption) via a large series of "future epoch" DTLS records that are buffered in a queue, aka "DTLS record buffer limitation bug."

CVSS vector

AV:N/AC:L/C:N/I:N/A:PExploitability: 10.0 | Impact: 2.9

Affected Packages3 packages

▶debiandebian/openssl< openssl 0.9.8k-1 (bookworm)
▶NVDopenssl/openssl0.9.8 — 0.9.8m
▶Debianopenssl/openssl< 0.9.8k-1+3

Patches

Patch: cvs.openssl.org ↗Patch: marc.info ↗Patch: rt.openssl.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-26xx-j6q3-j3rf: The dtls1_buffer_record function in ssl/d1_pkt↗2022-05-03
▶
OSV
CVE-2009-1377: The dtls1_buffer_record function in ssl/d1_pkt↗2009-05-19
▶

📋Vendor Advisories

3
Ubuntu
OpenSSL vulnerabilities↗2009-06-25
▶
Red Hat
OpenSSL: DTLS epoch record buffer memory DoS↗2009-05-12
▶
Debian
CVE-2009-1377: openssl - The dtls1_buffer_record function in ssl/d1_pkt.c in OpenSSL 0.9.8k and earlier 0...↗2009
▶

📄Research Papers

1
arXiv
One Bad Apple Spoils the Barrel: Understanding the Security Risks Introduced by Third-Party Components in IoT Firmware↗2022-12-29
▶

💬Community

1
Bugzilla
CVE-2009-1377 OpenSSL: DTLS epoch record buffer memory DoS↗2009-05-18
▶