CVE-2009-1377

Quick assessment

Copy summary Copy citation

Affected

n/a n/a

Exploitation

High exploitation probability; assess promptly

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OpenSSL是OpenSSL团队的一个开源的能够实现安全套接层（SSLv2/v3）和安全传输层（TLSv1）协议的通用加密库。该产品支持多种加密算法，包括对称密码、哈希算法、安全散列算法等。 OpenSSL 0.9.8k及之前版本和0.9.8版本中的ssl/d1_pkt.c文件的‘dtls1_buffer_record’函数存在缓冲区错误漏洞。远程攻击者可利用该漏洞造成拒绝服务（内存损坏）。

CVE-2009-1377 affects n/a n/a. High exploitation probability; assess promptly. OpenSSL是OpenSSL团队的一个开源的能够实现安全套接层（SSLv2/v3）和安全传输层（TLSv1）协议的通用加密库。该产品支持多种加密算法，包括对称密码、哈希算法、安全散列算法等。 OpenSSL 0.9.8k及之前版本和0.9.8版本中的ssl/d1_pkt.c文件的‘dtls1_buffer_record’函数存在缓冲区错误漏洞。远程攻击者可 CVE-2009-1377 vulnerability details, Shenlong CVE Platform, https://cve.imfht.com/detail/CVE-2009-1377

I. Basic Information for CVE-2009-1377

Affected Products

II. Public POCs for CVE-2009-1377

III. Intelligence Information for CVE-2009-1377

Vendor Advisories for CVE-2009-1377 (20)

• http://secunia.com/advisories/35571 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/35729 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/42724 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/38761 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/36533 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/38794 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/35461 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/35128 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/38834 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/35416 third-party-advisory x_refsource_SECUNIA
• http://www.securityfocus.com/bid/35001 vdb-entry x_refsource_BID
• http://secunia.com/advisories/42733 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/37003 third-party-advisory x_refsource_SECUNIA
• http://www.securitytracker.com/id?1022241 vdb-entry x_refsource_SECTRACK
• http://www.ubuntu.com/usn/USN-792-1 vendor-advisory x_refsource_UBUNTU
• http://www.vupen.com/english/advisories/2009/1377 vdb-entry x_refsource_VUPEN
• http://www.vupen.com/english/advisories/2010/0528 vdb-entry x_refsource_VUPEN
• http://www.mandriva.com/security/advisories?name=MDVSA-2009:120 vendor-advisory x_refsource_MANDRIVA
• 🔗 OpenSSL: Multiple vulnerabilities (GLSA 200912-01) — Gentoo security Read full article vendor-advisory x_refsource_GENTOO
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6683 vdb-entry signature x_refsource_OVAL

Mailing List Discussions for CVE-2009-1377 (4)

• http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html vendor-advisory x_refsource_SUSE
• http://www.openwall.com/lists/oss-security/2009/05/18/1 mailing-list x_refsource_MLIST
• http://marc.info/?l=openssl-dev&m=124247675613888&w=2 mailing-list x_refsource_MLIST
• http://lists.vmware.com/pipermail/security-announce/2010/000082.html mailing-list x_refsource_MLIST

Other References for CVE-2009-1377 (10)

• http://cvs.openssl.org/chngview?cn=18187 x_refsource_CONFIRM
• http://sourceforge.net/mailarchive/message.php?msg_name=4AD43807.7080105%40users.sourceforge.net x_refsource_CONFIRM
• http://rt.openssl.org/Ticket/Display.html?id=1930&user=guest&pass=guest x_refsource_CONFIRM
• http://voodoo-circle.sourceforge.net/sa/sa-20091012-01.html x_refsource_CONFIRM
• https://kb.bluecoat.com/index?page=content&id=SA50 x_refsource_CONFIRM
• https://launchpad.net/bugs/cve/2009-1377 x_refsource_MISC
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02029444 vendor-advisory x_refsource_HP
• http://www.redhat.com/support/errata/RHSA-2009-1335.html vendor-advisory x_refsource_REDHAT
• http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.663049 vendor-advisory x_refsource_SLACKWARE
• ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-009.txt.asc vendor-advisory x_refsource_NETBSD

• https://www.cve.org/CVERecord?id=CVE-2009-1377

Same Patch Batch · n/a · 2009-05-19 · 5 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2009-1377