CVE-2009-4355 Memory leak in the zlib_stateful_finish function in crypto/comp/c_zlib.c in OpenSSL 0.9.8l and earlier and 1.0.0 Beta through Beta 4 allows remote attackers to cause a denial of service (memory consum...
MediumCVSS 5.0
EPSS 9.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Memory leak in the zlib_stateful_finish function in crypto/comp/c_zlib.c in OpenSSL 0.9.8l and earlier and 1.0.0 Beta through Beta 4 allows remote attackers to cause a denial of service (memory consumption) via vectors that trigger incorrect calls to the CRYPTO_cleanup_all_ex_data function, as demonstrated by use of SSLv3 and PHP with the Apache HTTP Server, a related issue to CVE-2008-1678.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| OpenSSL | <= 0.9.8l | No fix listed |
| OpenSSL | = 0.9.1c | No fix listed |
| OpenSSL | = 0.9.2b | No fix listed |
| OpenSSL | = 0.9.3 | No fix listed |
| OpenSSL | = 0.9.3a | No fix listed |
| OpenSSL | = 0.9.4 | No fix listed |
| OpenSSL | = 0.9.5 | No fix listed |
| OpenSSL | = 0.9.5-beta1 | No fix listed |
| OpenSSL | = 0.9.5-beta2 | No fix listed |
| OpenSSL | = 0.9.5a | No fix listed |
| OpenSSL | = 0.9.5a-beta1 | No fix listed |
| OpenSSL | = 0.9.5a-beta2 | No fix listed |
| OpenSSL | = 0.9.6 | No fix listed |
| OpenSSL | = 0.9.6-beta1 | No fix listed |
| OpenSSL | = 0.9.6-beta2 | No fix listed |
| OpenSSL | = 0.9.6-beta3 | No fix listed |
| OpenSSL | = 0.9.6a | No fix listed |
| OpenSSL | = 0.9.6a-beta1 | No fix listed |
| OpenSSL | = 0.9.6a-beta2 | No fix listed |
| OpenSSL | = 0.9.6a-beta3 | No fix listed |
| OpenSSL | = 0.9.6b | No fix listed |
| OpenSSL | = 0.9.6c | No fix listed |
| OpenSSL | = 0.9.6d | No fix listed |
| OpenSSL | = 0.9.6e | No fix listed |
| OpenSSL | = 0.9.6f | No fix listed |
Show 49 more
| Product | Affected versions | Fixed in |
|---|---|---|
| OpenSSL | = 0.9.6g | No fix listed |
| OpenSSL | = 0.9.6h | No fix listed |
| OpenSSL | = 0.9.6i | No fix listed |
| OpenSSL | = 0.9.6j | No fix listed |
| OpenSSL | = 0.9.6k | No fix listed |
| OpenSSL | = 0.9.6l | No fix listed |
| OpenSSL | = 0.9.6m | No fix listed |
| OpenSSL | = 0.9.7 | No fix listed |
| OpenSSL | = 0.9.7-beta1 | No fix listed |
| OpenSSL | = 0.9.7-beta2 | No fix listed |
| OpenSSL | = 0.9.7-beta3 | No fix listed |
| OpenSSL | = 0.9.7-beta4 | No fix listed |
| OpenSSL | = 0.9.7-beta5 | No fix listed |
| OpenSSL | = 0.9.7-beta6 | No fix listed |
| OpenSSL | = 0.9.7a | No fix listed |
| OpenSSL | = 0.9.7b | No fix listed |
| OpenSSL | = 0.9.7c | No fix listed |
| OpenSSL | = 0.9.7d | No fix listed |
| OpenSSL | = 0.9.7e | No fix listed |
| OpenSSL | = 0.9.7f | No fix listed |
| OpenSSL | = 0.9.7g | No fix listed |
| OpenSSL | = 0.9.7h | No fix listed |
| OpenSSL | = 0.9.7i | No fix listed |
| OpenSSL | = 0.9.7j | No fix listed |
| OpenSSL | = 0.9.7k | No fix listed |
| OpenSSL | = 0.9.7l | No fix listed |
| OpenSSL | = 0.9.7m | No fix listed |
| OpenSSL | = 0.9.8 | No fix listed |
| OpenSSL | = 0.9.8a | No fix listed |
| OpenSSL | = 0.9.8b | No fix listed |
| OpenSSL | = 0.9.8c | No fix listed |
| OpenSSL | = 0.9.8d | No fix listed |
| OpenSSL | = 0.9.8e | No fix listed |
| OpenSSL | = 0.9.8f | No fix listed |
| OpenSSL | = 0.9.8g | No fix listed |
| OpenSSL | = 0.9.8h | No fix listed |
| OpenSSL | = 0.9.8i | No fix listed |
| OpenSSL | = 0.9.8j | No fix listed |
| OpenSSL | = 0.9.8k | No fix listed |
| OpenSSL | = 1.0.0-beta1 | No fix listed |
| OpenSSL | = 1.0.0-beta2 | No fix listed |
| OpenSSL | = 1.0.0-beta3 | No fix listed |
| OpenSSL | = 1.0.0-beta4 | No fix listed |
| redhat openssl | = 0.9.6-15 | No fix listed |
| redhat openssl | = 0.9.6b-3 | No fix listed |
| redhat openssl | = 0.9.7a-2 | No fix listed |
| debian/openssl(Debian:12) | < 0.9.8k-8 | 0.9.8k-8 |
| debian/openssl(Debian:13) | < 0.9.8k-8 | 0.9.8k-8 |
| debian/openssl(Debian:14) | < 0.9.8k-8 | 0.9.8k-8 |
References
- cvs.openssl.org
- cvs.openssl.org
- cvs.openssl.org
- FEDORA-2010-5744 vendor-advisory
- FEDORA-2010-5357 vendor-advisory
- SUSE-SA:2010:008 vendor-advisory
- HPSBUX02517 vendor-advisory
- 38175 third-party-advisory vendor-advisory
- 38181 third-party-advisory vendor-advisory
- 38200 third-party-advisory vendor-advisory
- 38761 third-party-advisory
- 39461 third-party-advisory
- 42724 third-party-advisory
- 42733 third-party-advisory
- SSA:2010-060-02 vendor-advisory
- wiki.rpath.com
- DSA-1970 vendor-advisory
- MDVSA-2010:022 vendor-advisory
- [oss-security] 20100113 [PATCH] memory consumption (DoS) in openssl CVE-2009-4355 mailing-list
- USN-884-1 vendor-advisory
- ADV-2010-0124 vdb-entry vendor-advisory
- ADV-2010-0839 vdb-entry
- ADV-2010-0916 vdb-entry
- bugzilla.redhat.com
- issues.rpath.com
- kb.bluecoat.com
- oval:org.mitre.oval:def:11260 signature vdb-entry
- oval:org.mitre.oval:def:12168 signature vdb-entry
- oval:org.mitre.oval:def:6678 signature vdb-entry
- RHSA-2010:0095 vendor-advisory
- Debian Security Tracker CVE-2009-4355 vendor-advisory