CVE-2009-1386
Summary
| CVE | CVE-2009-1386 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2009-06-04 16:30:00 UTC |
| Updated | 2023-02-13 02:20:00 UTC |
| Description | ssl/s3_pkt.c in OpenSSL before 0.9.8i allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a DTLS ChangeCipherSpec packet that occurs before ClientHello. |
Risk And Classification
Problem Types: CWE-476
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Canonical | Ubuntu Linux | 6.06 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 8.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 8.10 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 9.04 | All | All | All |
| Application | Openssl | Openssl | All | All | All | All |
| Application | Openssl | Openssl | 0.9.1c | All | All | All |
| Application | Openssl | Openssl | 0.9.2b | All | All | All |
| Application | Openssl | Openssl | 0.9.3 | All | All | All |
| Application | Openssl | Openssl | 0.9.3a | All | All | All |
| Application | Openssl | Openssl | 0.9.4 | All | All | All |
| Application | Openssl | Openssl | 0.9.5 | All | All | All |
| Application | Openssl | Openssl | 0.9.5 | beta1 | All | All |
| Application | Openssl | Openssl | 0.9.5a | All | All | All |
| Application | Openssl | Openssl | 0.9.5a | beta1 | All | All |
| Application | Openssl | Openssl | 0.9.5a | beta2 | All | All |
| Application | Openssl | Openssl | 0.9.6 | beta1 | All | All |
| Application | Openssl | Openssl | 0.9.6 | beta2 | All | All |
| Application | Openssl | Openssl | 0.9.6 | beta3 | All | All |
| Application | Openssl | Openssl | 0.9.6a | All | All | All |
| Application | Openssl | Openssl | 0.9.6a | beta1 | All | All |
| Application | Openssl | Openssl | 0.9.6a | beta2 | All | All |
| Application | Openssl | Openssl | 0.9.6a | beta3 | All | All |
| Application | Openssl | Openssl | 0.9.6b | All | All | All |
| Application | Openssl | Openssl | 0.9.6c | All | All | All |
| Application | Openssl | Openssl | 0.9.6d | All | All | All |
| Application | Openssl | Openssl | 0.9.6e | All | All | All |
| Application | Openssl | Openssl | 0.9.6f | All | All | All |
| Application | Openssl | Openssl | 0.9.6g | All | All | All |
| Application | Openssl | Openssl | 0.9.6h | All | All | All |
| Application | Openssl | Openssl | 0.9.6i | All | All | All |
| Application | Openssl | Openssl | 0.9.6j | All | All | All |
| Application | Openssl | Openssl | 0.9.6k | All | All | All |
| Application | Openssl | Openssl | 0.9.6l | All | All | All |
| Application | Openssl | Openssl | 0.9.6m | All | All | All |
| Application | Openssl | Openssl | 0.9.7 | beta1 | All | All |
| Application | Openssl | Openssl | 0.9.7 | beta2 | All | All |
| Application | Openssl | Openssl | 0.9.7 | beta3 | All | All |
| Application | Openssl | Openssl | 0.9.7 | beta4 | All | All |
| Application | Openssl | Openssl | 0.9.7 | beta5 | All | All |
| Application | Openssl | Openssl | 0.9.7 | beta6 | All | All |
| Application | Openssl | Openssl | 0.9.7a | All | All | All |
| Application | Openssl | Openssl | 0.9.7b | All | All | All |
| Application | Openssl | Openssl | 0.9.7c | All | All | All |
| Application | Openssl | Openssl | 0.9.7d | All | All | All |
| Application | Openssl | Openssl | 0.9.7e | All | All | All |
| Application | Openssl | Openssl | 0.9.7f | All | All | All |
| Application | Openssl | Openssl | 0.9.7g | All | All | All |
| Application | Openssl | Openssl | 0.9.7h | All | All | All |
| Application | Openssl | Openssl | 0.9.7i | All | All | All |
| Application | Openssl | Openssl | 0.9.7j | All | All | All |
| Application | Openssl | Openssl | 0.9.7k | All | All | All |
| Application | Openssl | Openssl | 0.9.7l | All | All | All |
| Application | Openssl | Openssl | 0.9.7m | All | All | All |
| Application | Openssl | Openssl | 0.9.8 | All | All | All |
| Application | Openssl | Openssl | 0.9.8 | - | All | All |
| Application | Openssl | Openssl | 0.9.8a | All | All | All |
| Application | Openssl | Openssl | 0.9.8b | All | All | All |
| Application | Openssl | Openssl | 0.9.8c | All | All | All |
| Application | Openssl | Openssl | 0.9.8d | All | All | All |
| Application | Openssl | Openssl | 0.9.8e | All | All | All |
| Application | Openssl | Openssl | 0.9.8f | All | All | All |
| Application | Openssl | Openssl | 0.9.8g | All | All | All |
| Application | Openssl | Openssl | 0.9.8h | All | All | All |
| Application | Openssl | Openssl | 0.9.1c | All | All | All |
| Application | Openssl | Openssl | 0.9.2b | All | All | All |
| Application | Openssl | Openssl | 0.9.3 | All | All | All |
| Application | Openssl | Openssl | 0.9.3a | All | All | All |
| Application | Openssl | Openssl | 0.9.4 | All | All | All |
| Application | Openssl | Openssl | 0.9.5 | All | All | All |
| Application | Openssl | Openssl | 0.9.5 | beta1 | All | All |
| Application | Openssl | Openssl | 0.9.5a | All | All | All |
| Application | Openssl | Openssl | 0.9.5a | beta1 | All | All |
| Application | Openssl | Openssl | 0.9.5a | beta2 | All | All |
| Application | Openssl | Openssl | 0.9.6 | beta1 | All | All |
| Application | Openssl | Openssl | 0.9.6 | beta2 | All | All |
| Application | Openssl | Openssl | 0.9.6 | beta3 | All | All |
| Application | Openssl | Openssl | 0.9.6a | All | All | All |
| Application | Openssl | Openssl | 0.9.6a | beta1 | All | All |
| Application | Openssl | Openssl | 0.9.6a | beta2 | All | All |
| Application | Openssl | Openssl | 0.9.6a | beta3 | All | All |
| Application | Openssl | Openssl | 0.9.6b | All | All | All |
| Application | Openssl | Openssl | 0.9.6c | All | All | All |
| Application | Openssl | Openssl | 0.9.6d | All | All | All |
| Application | Openssl | Openssl | 0.9.6e | All | All | All |
| Application | Openssl | Openssl | 0.9.6f | All | All | All |
| Application | Openssl | Openssl | 0.9.6g | All | All | All |
| Application | Openssl | Openssl | 0.9.6h | All | All | All |
| Application | Openssl | Openssl | 0.9.6i | All | All | All |
| Application | Openssl | Openssl | 0.9.6j | All | All | All |
| Application | Openssl | Openssl | 0.9.6k | All | All | All |
| Application | Openssl | Openssl | 0.9.6l | All | All | All |
| Application | Openssl | Openssl | 0.9.6m | All | All | All |
| Application | Openssl | Openssl | 0.9.7 | beta1 | All | All |
| Application | Openssl | Openssl | 0.9.7 | beta2 | All | All |
| Application | Openssl | Openssl | 0.9.7 | beta3 | All | All |
| Application | Openssl | Openssl | 0.9.7 | beta4 | All | All |
| Application | Openssl | Openssl | 0.9.7 | beta5 | All | All |
| Application | Openssl | Openssl | 0.9.7 | beta6 | All | All |
| Application | Openssl | Openssl | 0.9.7a | All | All | All |
| Application | Openssl | Openssl | 0.9.7b | All | All | All |
| Application | Openssl | Openssl | 0.9.7c | All | All | All |
| Application | Openssl | Openssl | 0.9.7d | All | All | All |
| Application | Openssl | Openssl | 0.9.7e | All | All | All |
| Application | Openssl | Openssl | 0.9.7f | All | All | All |
| Application | Openssl | Openssl | 0.9.7g | All | All | All |
| Application | Openssl | Openssl | 0.9.7h | All | All | All |
| Application | Openssl | Openssl | 0.9.7i | All | All | All |
| Application | Openssl | Openssl | 0.9.7j | All | All | All |
| Application | Openssl | Openssl | 0.9.7k | All | All | All |
| Application | Openssl | Openssl | 0.9.7l | All | All | All |
| Application | Openssl | Openssl | 0.9.7m | All | All | All |
| Application | Openssl | Openssl | 0.9.8 | All | All | All |
| Application | Openssl | Openssl | 0.9.8a | All | All | All |
| Application | Openssl | Openssl | 0.9.8b | All | All | All |
| Application | Openssl | Openssl | 0.9.8c | All | All | All |
| Application | Openssl | Openssl | 0.9.8d | All | All | All |
| Application | Openssl | Openssl | 0.9.8e | All | All | All |
| Application | Openssl | Openssl | 0.9.8f | All | All | All |
| Application | Openssl | Openssl | 0.9.8g | All | All | All |
| Application | Openssl | Openssl | 0.9.8h | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8c-1 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8c-2 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8c-3 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8c-4 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8c-5 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8c-6 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8c-7 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8c-8 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8c-9 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8d-1 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8d-2 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8d-3 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8d-4 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8d-5 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8d-6 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8d-7 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8d-8 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8d-9 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8e-1 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8e-2 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8e-3 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8e-4 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8e-5 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8e-6 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8e-7 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8e-8 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8e-9 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8f | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8f-1 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8f-2 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8f-3 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8f-4 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8f-5 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8f-6 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8f-7 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8f-8 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8f-9 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8g-1 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8g-2 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8g-3 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8g-4 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8g-5 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8g-6 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8g-7 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8g-8 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8g-9 | All | All | All |
| Application | Openssl Project | Openssl | All | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8c-1 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8c-2 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8c-3 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8c-4 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8c-5 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8c-6 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8c-7 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8c-8 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8c-9 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8d-1 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8d-2 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8d-3 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8d-4 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8d-5 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8d-6 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8d-7 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8d-8 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8d-9 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8e-1 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8e-2 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8e-3 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8e-4 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8e-5 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8e-6 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8e-7 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8e-8 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8e-9 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8f | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8f-1 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8f-2 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8f-3 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8f-4 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8f-5 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8f-6 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8f-7 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8f-8 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8f-9 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8g-1 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8g-2 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8g-3 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8g-4 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8g-5 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8g-6 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8g-7 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8g-8 | All | All | All |
| Application | Openssl Project | Openssl | 0.9.8g-9 | All | All | All |
| Application | Redhat | Openssl | 0.9.6-15 | All | All | All |
| Application | Redhat | Openssl | 0.9.6-15 | All | i386 | All |
| Application | Redhat | Openssl | 0.9.6b-3 | All | All | All |
| Application | Redhat | Openssl | 0.9.6b-3 | All | i386 | All |
| Application | Redhat | Openssl | 0.9.7a-2 | All | All | All |
| Application | Redhat | Openssl | 0.9.7a-2 | All | i386 | All |
| Application | Redhat | Openssl | 0.9.7a-2 | All | i386_dev | All |
| Application | Redhat | Openssl | 0.9.7a-2 | All | i386_perl | All |
| Application | Redhat | Openssl | 0.9.6-15 | All | All | All |
| Application | Redhat | Openssl | 0.9.6-15 | All | i386 | All |
| Application | Redhat | Openssl | 0.9.6b-3 | All | All | All |
| Application | Redhat | Openssl | 0.9.6b-3 | All | i386 | All |
| Application | Redhat | Openssl | 0.9.7a-2 | All | All | All |
| Application | Redhat | Openssl | 0.9.7a-2 | All | i386 | All |
| Application | Redhat | Openssl | 0.9.7a-2 | All | i386_dev | All |
| Application | Redhat | Openssl | 0.9.7a-2 | All | i386_perl | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| oss-security - Re: Two OpenSSL DTLS remote DoS | MLIST | www.openwall.com | |
| access.redhat.com | CVE-2009-1386 | MISC | access.redhat.com | |
| HPSBMA02492 SSRT100079 rev.1 - HP System Management Homepage (SMH) for Linux and Windows, Remote Cross Site Scripting (XSS), Denial of Service (DoS), Execution of Arbitrary Code, Unauthorized Access - c02029444 - HP Business Support Center | HP | h20000.www2.hp.com | |
| Ubuntu update for openssl - Secunia.com | SECUNIA | secunia.com | |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | VUPEN | www.vupen.com | |
| IBM X-Force Exchange | XF | exchange.xforce.ibmcloud.com | |
| Red Hat Customer Portal | MISC | access.redhat.com | |
| #1679: DTLS: SegFault if ChangeCipherSpec is received before ClientHello | CONFIRM | rt.openssl.org | Vendor Advisory |
| OpenSSL 'ChangeCipherSpec' DTLS Packet Denial of Service Vulnerability | BID | www.securityfocus.com | Exploit |
| Repository / Oval Repository | OVAL | oval.cisecurity.org | |
| NetBSD update for openssl - Secunia Advisories - Vulnerability Information - Secunia.com | SECUNIA | secunia.com | |
| NetBSD-SA2009-009 | NETBSD | ftp.netbsd.org | |
| 503685 – (CVE-2009-1386) CVE-2009-1386 openssl: DTLS NULL deref crash on early ChangeCipherSpec request | MISC | bugzilla.redhat.com | |
| cvs.openssl.org/chngview | CONFIRM | cvs.openssl.org | Patch |
| VMware vMA Update for Multiple Packages - Advisories - Community | SECUNIA | secunia.com | |
| SUSE Update for Multiple Packages - Secunia Advisories - Vulnerability Information - Secunia.com | SECUNIA | secunia.com | |
| [security-announce] SUSE Security Summary Report: SUSE-SR:2009:012 | SUSE | lists.opensuse.org | |
| Support | REDHAT | www.redhat.com | |
| [Security-announce] VMSA-2010-0004 ESX Service Console and vMA third party updates | MLIST | lists.vmware.com | |
| USN-792-1: OpenSSL vulnerabilities | Ubuntu | UBUNTU | www.ubuntu.com | |
| VMware ESX Server 4 Multiple Vulnerabilities - Advisories - Community | SECUNIA | secunia.com | |
| Repository / Oval Repository | OVAL | oval.cisecurity.org | |
| OpenSSL < 0.9.8i DTLS ChangeCipherSpec Remote DoS Exploit | EXPLOIT-DB | www.exploit-db.com | |
| Secunia Advisories - Vulnerability Information - Secunia.com | SECUNIA | secunia.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.