Executive Summary

Informations
Name CVE-2009-1379 First vendor Publication 2009-05-19
Vendor Cve Last vendor Modification 2024-11-21

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:P)
Cvss Base Score 5 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Use-after-free vulnerability in the dtls1_retrieve_buffered_fragment function in ssl/d1_both.c in OpenSSL 1.0.0 Beta 2 allows remote attackers to cause a denial of service (openssl s_client crash) and possibly have unspecified other impact via a DTLS packet, as demonstrated by a packet from a server that uses a crafted server certificate.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1379

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-399 Resource Management Errors

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:25119
 
Oval ID: oval:org.mitre.oval:def:25119
Title: Vulnerability in OpenSSL 1.0.0 Beta 2, allows remote attackers to cause a denial of service (openssl s_client crash)
Description: Use-after-free vulnerability in the dtls1_retrieve_buffered_fragment function in ssl/d1_both.c in OpenSSL 1.0.0 Beta 2 allows remote attackers to cause a denial of service (openssl s_client crash) and possibly have unspecified other impact via a DTLS packet, as demonstrated by a packet from a server that uses a crafted server certificate.
Family: windows Class: vulnerability
Reference(s): CVE-2009-1379
 Version: 3
Platform(s): Microsoft Windows XP
Microsoft Windows Server 2003
Microsoft Windows Vista
Microsoft Windows 7
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows 8
Microsoft Windows 8.1
Microsoft Windows Server 2012
Microsoft Windows Server 2012 R2
 Product(s): OpenSSL
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:6848
 
Oval ID: oval:org.mitre.oval:def:6848
Title: OpenSSL 'dtls1_retrieve_buffered_fragment()' DTLS Packet Denial of Service Vulnerability
Description: Use-after-free vulnerability in the dtls1_retrieve_buffered_fragment function in ssl/d1_both.c in OpenSSL 1.0.0 Beta 2 allows remote attackers to cause a denial of service (openssl s_client crash) and possibly have unspecified other impact via a DTLS packet, as demonstrated by a packet from a server that uses a crafted server certificate.
Family: unix Class: vulnerability
Reference(s): CVE-2009-1379
 Version: 5
Platform(s): VMWare ESX Server 4.0
 Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:9744
 
Oval ID: oval:org.mitre.oval:def:9744
Title: Use-after-free vulnerability in the dtls1_retrieve_buffered_fragment function in ssl/d1_both.c in OpenSSL 1.0.0 Beta 2 allows remote attackers to cause a denial of service (openssl s_client crash) and possibly have unspecified other impact via a DTLS packet, as demonstrated by a packet from a server that uses a crafted server certificate.
Description: Use-after-free vulnerability in the dtls1_retrieve_buffered_fragment function in ssl/d1_both.c in OpenSSL 1.0.0 Beta 2 allows remote attackers to cause a denial of service (openssl s_client crash) and possibly have unspecified other impact via a DTLS packet, as demonstrated by a packet from a server that uses a crafted server certificate.
Family: unix Class: vulnerability
Reference(s): CVE-2009-1379
 Version: 5
Platform(s): Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
 Product(s):
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 1

OpenVAS Exploits

Date Description
2012-04-16 Name : VMSA-2010-0009: ESXi utilities and ESX Service Console third party updates
File : nvt/gb_VMSA-2010-0009.nasl
2011-08-09 Name : CentOS Update for openssl CESA-2009:1335 centos5 i386
File : nvt/gb_CESA-2009_1335_openssl_centos5_i386.nasl
2010-06-25 Name : Fedora Update for openssl FEDORA-2010-9421
File : nvt/gb_fedora_2010_9421_openssl_fc11.nasl
2010-04-19 Name : Fedora Update for openssl FEDORA-2010-5357
File : nvt/gb_fedora_2010_5357_openssl_fc11.nasl
2009-12-14 Name : Gentoo Security Advisory GLSA 200912-01 (openssl)
File : nvt/glsa_200912_01.nasl
2009-12-10 Name : Mandriva Security Advisory MDVSA-2009:310 (openssl)
File : nvt/mdksa_2009_310.nasl
2009-10-13 Name : SLES10: Security update for OpenSSL
File : nvt/sles10_openssl0.nasl
2009-10-11 Name : SLES11: Security update for OpenSSL
File : nvt/sles11_libopenssl0_9_80.nasl
2009-09-28 Name : Mandrake Security Advisory MDVSA-2009:239 (openssl)
File : nvt/mdksa_2009_239.nasl
2009-09-28 Name : Mandrake Security Advisory MDVSA-2009:238 (openssl)
File : nvt/mdksa_2009_238.nasl
2009-09-21 Name : Debian Security Advisory DSA 1888-1 (openssl, openssl097)
File : nvt/deb_1888_1.nasl
2009-09-21 Name : CentOS Security Advisory CESA-2009:1335 (openssl)
File : nvt/ovcesa2009_1335.nasl
2009-09-09 Name : RedHat Security Advisory RHSA-2009:1335
File : nvt/RHSA_2009_1335.nasl
2009-06-30 Name : Ubuntu USN-792-1 (openssl)
File : nvt/ubuntu_792_1.nasl
2009-06-23 Name : Fedora Core 11 FEDORA-2009-5452 (openssl)
File : nvt/fcore_2009_5452.nasl
2009-06-23 Name : Fedora Core 9 FEDORA-2009-5423 (openssl)
File : nvt/fcore_2009_5423.nasl
2009-06-23 Name : Fedora Core 10 FEDORA-2009-5412 (openssl)
File : nvt/fcore_2009_5412.nasl
2009-06-15 Name : SuSE Security Summary SUSE-SR:2009:011
File : nvt/suse_sr_2009_011.nasl
2009-05-28 Name : OpenSSL DTLS Packets Multiple Denial of Service Vulnerabilities (Linux)
File : nvt/secpod_openssl_mult_dos_vuln_lin.nasl
2009-05-28 Name : OpenSSL DTLS Packets Multiple DOS Vulnerabilities (win)
File : nvt/secpod_openssl_mult_dos_vuln_win.nasl
0000-00-00 Name : Slackware Advisory SSA:2010-060-02 openssl
File : nvt/esoft_slk_ssa_2010_060_02.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
54614 OpenSSL ssl/d1_both.c dtls1_retrieve_buffered_fragment Function DTLS Packet H...

Nessus® Vulnerability Scanner

Date Description
2016-03-08 Name : The remote VMware ESX / ESXi host is missing a security-related patch.
File : vmware_VMSA-2010-0009_remote.nasl - Type : ACT_GATHER_INFO
2016-03-08 Name : The remote VMware ESX host is missing a security-related patch.
File : vmware_VMSA-2010-0004_remote.nasl - Type : ACT_GATHER_INFO
2013-01-24 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2009-1335.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20090902_openssl_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-01-04 Name : The remote server is affected by a denial of service vulnerability.
File : openssl_1_0_0.nasl - Type : ACT_GATHER_INFO
2010-07-30 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2009-239.nasl - Type : ACT_GATHER_INFO
2010-06-01 Name : The remote VMware ESXi / ESX host is missing one or more security-related pat...
File : vmware_VMSA-2010-0009.nasl - Type : ACT_GATHER_INFO
2010-04-27 Name : The remote web server has multiple vulnerabilities.
File : hpsmh_6_0_0_95.nasl - Type : ACT_GATHER_INFO
2010-03-05 Name : The remote VMware ESX host is missing one or more security-related patches.
File : vmware_VMSA-2010-0004.nasl - Type : ACT_GATHER_INFO
2010-03-02 Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2010-060-02.nasl - Type : ACT_GATHER_INFO
2010-02-24 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1888.nasl - Type : ACT_GATHER_INFO
2010-01-06 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2009-1335.nasl - Type : ACT_GATHER_INFO
2009-12-04 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2009-310.nasl - Type : ACT_GATHER_INFO
2009-12-02 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200912-01.nasl - Type : ACT_GATHER_INFO
2009-09-24 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_libopenssl-devel-090522.nasl - Type : ACT_GATHER_INFO
2009-09-24 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_openssl-6267.nasl - Type : ACT_GATHER_INFO
2009-09-22 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2009-238.nasl - Type : ACT_GATHER_INFO
2009-07-21 Name : The remote openSUSE host is missing a security update.
File : suse_11_0_libopenssl-devel-090522.nasl - Type : ACT_GATHER_INFO
2009-07-21 Name : The remote openSUSE host is missing a security update.
File : suse_11_1_libopenssl-devel-090522.nasl - Type : ACT_GATHER_INFO
2009-06-26 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-792-1.nasl - Type : ACT_GATHER_INFO
2009-06-21 Name : The remote Fedora host is missing a security update.
File : fedora_2009-5452.nasl - Type : ACT_GATHER_INFO
2009-06-21 Name : The remote Fedora host is missing a security update.
File : fedora_2009-5423.nasl - Type : ACT_GATHER_INFO
2009-06-21 Name : The remote Fedora host is missing a security update.
File : fedora_2009-5412.nasl - Type : ACT_GATHER_INFO
2009-05-27 Name : The remote openSUSE host is missing a security update.
File : suse_libopenssl-devel-6268.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-009.txt.asc
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02029444
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02029444
http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html
http://lists.vmware.com/pipermail/security-announce/2010/000082.html
http://rt.openssl.org/Ticket/Display.html?id=1923&user=guest&pass=guest
http://secunia.com/advisories/35416
http://secunia.com/advisories/35461
http://secunia.com/advisories/35571
http://secunia.com/advisories/35729
http://secunia.com/advisories/36533
http://secunia.com/advisories/37003
http://secunia.com/advisories/38761
http://secunia.com/advisories/38794
http://secunia.com/advisories/38834
http://secunia.com/advisories/42724
http://secunia.com/advisories/42733
http://security.gentoo.org/glsa/glsa-200912-01.xml
http://slackware.com/security/viewer.php?l=slackware-security&y=2010&...
http://sourceforge.net/mailarchive/message.php?msg_name=4AD43807.7080105%40us...
http://voodoo-circle.sourceforge.net/sa/sa-20091012-01.html
http://www.openwall.com/lists/oss-security/2009/05/18/4
http://www.redhat.com/support/errata/RHSA-2009-1335.html
http://www.securityfocus.com/bid/35138
http://www.securitytracker.com/id?1022241
http://www.ubuntu.com/usn/USN-792-1
http://www.vupen.com/english/advisories/2009/1377
http://www.vupen.com/english/advisories/2010/0528
https://exchange.xforce.ibmcloud.com/vulnerabilities/50661
https://kb.bluecoat.com/index?page=content&id=SA50
https://launchpad.net/bugs/cve/2009-1379
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
Source Url

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
10
11
12
13
Date Informations
2024-11-28 23:11:19
  • Multiple Updates
2024-11-28 12:18:48
  • Multiple Updates
2023-02-13 09:29:19
  • Multiple Updates
2023-02-02 21:28:57
  • Multiple Updates
2021-05-04 12:09:28
  • Multiple Updates
2021-04-22 01:09:48
  • Multiple Updates
2020-05-23 00:23:40
  • Multiple Updates
2017-09-29 09:24:11
  • Multiple Updates
2017-08-17 09:22:33
  • Multiple Updates
2016-04-26 18:46:33
  • Multiple Updates
2016-03-09 13:25:54
  • Multiple Updates
2014-02-17 10:49:46
  • Multiple Updates
2013-05-10 23:49:16
  • Multiple Updates
2013-01-23 13:21:50
  • Multiple Updates