Vulnerability Description
Memory leak in the zlib_stateful_init function in crypto/comp/c_zlib.c in libssl in OpenSSL 0.9.8f through 0.9.8h allows remote attackers to cause a denial of service (memory consumption) via multiple calls, as demonstrated by initial SSL client handshakes to the Apache HTTP Server mod_ssl that specify a compression algorithm.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openssl | Openssl | 0.9.8f |
Related Weaknesses (CWE)
References
- http://bugs.gentoo.org/show_bug.cgi?id=222643
- http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00000.html
- http://marc.info/?l=openssl-dev&m=121060672602371&w=2Exploit
- http://secunia.com/advisories/31026Vendor Advisory
- http://secunia.com/advisories/31416
- http://secunia.com/advisories/32222
- http://secunia.com/advisories/34219
- http://secunia.com/advisories/35264
- http://secunia.com/advisories/38761
- http://secunia.com/advisories/42724
- http://secunia.com/advisories/42733
- http://secunia.com/advisories/44183
- http://security.gentoo.org/glsa/glsa-200807-06.xml
- http://securityreason.com/securityalert/3981
FAQ
What is CVE-2008-1678?
CVE-2008-1678 is a vulnerability with a CVSS score of 5.0 (MEDIUM). Memory leak in the zlib_stateful_init function in crypto/comp/c_zlib.c in libssl in OpenSSL 0.9.8f through 0.9.8h allows remote attackers to cause a denial of service (memory consumption) via multiple...
How severe is CVE-2008-1678?
CVE-2008-1678 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2008-1678?
Check the references section above for vendor advisories and patch information. Affected products include: Openssl Openssl.