CVE-2009-1377: openssl

Modified

AliasesDEBIAN-CVE-2009-1377

Published 19-05-2009Last modified 07-08-2024

Some data may be incomplete

1 reference with an unsupported link type was hidden.

Vulnerability summary

CVE-2009-1377 is a medium (CVSS 5.0) vulnerability in openssl. EPSS estimates a 11.27% chance of exploitation in the next 30 days, higher than 95.9% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 5, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

5.0/10

010

Medium · v2.0 (NVD)

EPSS score

11.27%

0%100%

Medium · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 1

OPENSUSE-SU-2024:11127-1 RHSA-2009:1335

Timeline

19-05-2009
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

The dtls1_buffer_record function in ssl/d1_pkt.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allows remote attackers to cause a denial of service (memory consumption) via a large series of "future epoch" DTLS records that are buffered in a queue, aka "DTLS record buffer limitation bug."

CVSS metrics

1 score · 1 source · 1 version

v2.05.0

EPSS trend

Probability

11.27%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

No change 0.00 pp

From 11.27% on 05-10-2026

05-10-202604-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Debian1 product

openssl< 0.9.8k-1

Openssl1 product

openssl≥ 0.9.8, < 0.9.8m

2 vendors · 2 products

References

35 links

secunia.com/advisories/42724Third Party AdvisoryX Refsource SECUNIA
rt.openssl.org/Ticket/Display.html?id=1930&user=guest&pass=guestX Refsource CONFIRMBroken LinkMailing ListPatchThird Party Advisory
slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.663049Vendor AdvisoryX Refsource SLACKWAREMailing ListThird Party Advisory
secunia.com/advisories/38794Third Party AdvisoryX Refsource SECUNIA
lists.vmware.com/pipermail/security-announce/2010/000082.htmlMailing ListX Refsource MLISTThird Party Advisory
www.vupen.com/english/advisories/2009/1377VDB EntryX Refsource VUPENPermissions RequiredThird Party Advisory
secunia.com/advisories/35729Third Party AdvisoryX Refsource SECUNIA
security.gentoo.org/glsa/glsa-200912-01.xmlVendor AdvisoryX Refsource GENTOOThird Party Advisory
www.redhat.com/support/errata/RHSA-2009-1335.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02029444Vendor AdvisoryX Refsource HPBroken LinkThird Party Advisory

Show all 35 references

secunia.com/advisories/38761Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/37003Third Party AdvisoryX Refsource SECUNIA
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9663VDB EntrySignatureX Refsource OVALTool Signature
launchpad.net/bugs/cve/2009-1377X Refsource MISCThird Party Advisory
secunia.com/advisories/36533Third Party AdvisoryX Refsource SECUNIA
www.securitytracker.com/id?1022241VDB EntryX Refsource SECTRACKThird Party Advisory
www.ubuntu.com/usn/USN-792-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
voodoo-circle.sourceforge.net/sa/sa-20091012-01.htmlX Refsource CONFIRMThird Party Advisory
www.openwall.com/lists/oss-security/2009/05/18/1Mailing ListX Refsource MLIST
marc.info?l=openssl-dev&m=124247675613888&w=2Mailing ListX Refsource MLISTPatchThird Party Advisory
www.securityfocus.com/bid/35001VDB EntryX Refsource BIDThird Party Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6683VDB EntrySignatureX Refsource OVALTool Signature
secunia.com/advisories/38834Third Party AdvisoryX Refsource SECUNIA
cvs.openssl.org/chngview?cn=18187X Refsource CONFIRMBroken LinkPatchThird Party Advisory
www.mandriva.com/security/advisories?name=MDVSA-2009:120Vendor AdvisoryX Refsource MANDRIVABroken Link
secunia.com/advisories/35461Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/35128Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/35571Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/35416Third Party AdvisoryX Refsource SECUNIA
sourceforge.net/mailarchive/message.php?msg_name=4AD43807.7080105%40users.sourceforge.netX Refsource CONFIRMBroken Link
kb.bluecoat.com/index?page=content&id=SA50X Refsource CONFIRMBroken Link
secunia.com/advisories/42733Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2010/0528VDB EntryX Refsource VUPENPermissions RequiredThird Party Advisory
security-tracker.debian.org/tracker/CVE-2009-1377Advisory