Vulnerability Description
ssl/s3_pkt.c in OpenSSL before 0.9.8i allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a DTLS ChangeCipherSpec packet that occurs before ClientHello.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openssl | Openssl | < 0.9.8i |
| Redhat | Openssl | 0.9.6-15 |
| Canonical | Ubuntu Linux | 6.06 |
Related Weaknesses (CWE)
References
- ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-009.txt.ascBroken LinkThird Party Advisory
- http://cvs.openssl.org/chngview?cn=17369Broken LinkPatchThird Party Advisory
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02029444Broken LinkThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.htmlThird Party Advisory
- http://lists.vmware.com/pipermail/security-announce/2010/000082.htmlMailing ListThird Party Advisory
- http://rt.openssl.org/Ticket/Display.html?id=1679&user=guest&pass=guestThird Party AdvisoryVendor Advisory
- http://secunia.com/advisories/35571Not ApplicableThird Party Advisory
- http://secunia.com/advisories/35685Not ApplicableThird Party Advisory
- http://secunia.com/advisories/35729Not ApplicableThird Party Advisory
- http://secunia.com/advisories/36533Not ApplicableThird Party Advisory
- http://secunia.com/advisories/38794Not ApplicableThird Party Advisory
- http://secunia.com/advisories/38834Third Party Advisory
- http://www.openwall.com/lists/oss-security/2009/06/02/1Mailing ListThird Party Advisory
- http://www.redhat.com/support/errata/RHSA-2009-1335.htmlThird Party Advisory
- http://www.securityfocus.com/bid/35174Broken LinkExploitThird Party Advisory
FAQ
What is CVE-2009-1386?
CVE-2009-1386 is a vulnerability with a CVSS score of 5.0 (MEDIUM). ssl/s3_pkt.c in OpenSSL before 0.9.8i allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a DTLS ChangeCipherSpec packet that occurs before ClientHello...
How severe is CVE-2009-1386?
CVE-2009-1386 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2009-1386?
Check the references section above for vendor advisories and patch information. Affected products include: Openssl Openssl, Redhat Openssl, Canonical Ubuntu Linux.