CVE-2009-1379— OpenSSL 资源管理错误漏洞

一分钟漏洞结论

复制摘要 复制引用

影响对象

n/a n/a

利用判断

利用概率较高，应尽快评估

建议动作

优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。

OpenSSL是OpenSSL团队的一个开源的能够实现安全套接层（SSLv2/v3）和安全传输层（TLSv1）协议的通用加密库。该产品支持多种加密算法，包括对称密码、哈希算法、安全散列算法等。 OpenSSL资源管理错误漏洞，该漏洞源于如果远程攻击者从使用特制证书的服务器发送了DTLS报文的话，可能导致客户端崩溃。

CVE-2009-1379 影响 n/a n/a。利用概率较高，应尽快评估。OpenSSL是OpenSSL团队的一个开源的能够实现安全套接层（SSLv2/v3）和安全传输层（TLSv1）协议的通用加密库。该产品支持多种加密算法，包括对称密码、哈希算法、安全散列算法等。 OpenSSL资源管理错误漏洞，该漏洞源于如果远程攻击者从使用特制证书的服务器发送了DTLS报文的话，可能导致客户端崩溃。 CVE-2009-1379 漏洞详情，神龙漏洞库，https://cve.imfht.com/detail/CVE-2009-1379

一、 漏洞 CVE-2009-1379 基础信息

受影响产品

二、漏洞 CVE-2009-1379 的公开POC

三、漏洞 CVE-2009-1379 的情报信息

CVE-2009-1379 厂商安全公告 (19)

• http://secunia.com/advisories/38834 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/35416 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/38761 third-party-advisory x_refsource_SECUNIA
• http://www.securityfocus.com/bid/35138 vdb-entry x_refsource_BID
• http://secunia.com/advisories/42733 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/35571 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/37003 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/42724 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/36533 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/35461 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/35729 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/38794 third-party-advisory x_refsource_SECUNIA
• http://www.securitytracker.com/id?1022241 vdb-entry x_refsource_SECTRACK
• http://www.ubuntu.com/usn/USN-792-1 vendor-advisory x_refsource_UBUNTU
• http://www.vupen.com/english/advisories/2009/1377 vdb-entry x_refsource_VUPEN
• http://www.vupen.com/english/advisories/2010/0528 vdb-entry x_refsource_VUPEN
• 🔗 OpenSSL: Multiple vulnerabilities (GLSA 200912-01) — Gentoo security 查看完整文章 vendor-advisory x_refsource_GENTOO
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6848 vdb-entry signature x_refsource_OVAL
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50661 vdb-entry x_refsource_XF

CVE-2009-1379 邮件列表归档 (3)

• http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html vendor-advisory x_refsource_SUSE
• http://www.openwall.com/lists/oss-security/2009/05/18/4 mailing-list x_refsource_MLIST
• http://lists.vmware.com/pipermail/security-announce/2010/000082.html mailing-list x_refsource_MLIST

CVE-2009-1379 其他参考 (9)

• http://sourceforge.net/mailarchive/message.php?msg_name=4AD43807.7080105%40users.sourceforge.net x_refsource_CONFIRM
• https://launchpad.net/bugs/cve/2009-1379 x_refsource_MISC
• http://rt.openssl.org/Ticket/Display.html?id=1923&user=guest&pass=guest x_refsource_CONFIRM
• https://kb.bluecoat.com/index?page=content&id=SA50 x_refsource_CONFIRM
• http://voodoo-circle.sourceforge.net/sa/sa-20091012-01.html x_refsource_CONFIRM
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02029444 vendor-advisory x_refsource_HP
• http://www.redhat.com/support/errata/RHSA-2009-1335.html vendor-advisory x_refsource_REDHAT
• http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.663049 vendor-advisory x_refsource_SLACKWARE
• ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-009.txt.asc vendor-advisory x_refsource_NETBSD

• https://www.cve.org/CVERecord?id=CVE-2009-1379

同批安全公告 · n/a · 2009-05-19 · 共 5 条

IV. Related Vulnerabilities

V. Comments for CVE-2009-1379