CVE-2009-1386

Advisory lineage Upstream: 0 Downstream: 3
Modified
Published: 04 Jun 2009, 16:00
Last modified:07 Aug 2024, 05:13

Vulnerability Summary

Overall Risk (default)
medium
40/100
CVSS Score
5 MEDIUM
v2.0 (nvd)
EPSS Score
47.63% HIGH
48% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
3 found
Dark Web
Not detected

Timeline

04 Jun 2009, 16:00
Published
Vulnerability first disclosed
07 Aug 2024, 05:13
Last Modified
Vulnerability information updated

Description

ssl/s3_pkt.c in OpenSSL before 0.9.8i allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a DTLS ChangeCipherSpec packet that occurs before ClientHello.

CVSS Metrics

  • v2.0•MEDIUM•Score: 5AV:N/AC:L/Au:N/C:N/I:N/A:P

EPSS Trends

Current EPSS score: 47.63%• Percentile: 98%

Techniques & Countermeasures

  • CWE-476•NULL Pointer Dereference

    The product dereferences a pointer that it expects to be valid but is NULL.

Affected Systems

  • canonical•ubuntu_linux

    6.06 | 8.04 | 8.10 | 9.04

  • Unknown•OpenSSL

    > 0.9.8, < 0.9.8i

  • redhat•openssl

    0.9.6-15 | 0.9.6b-3 | 0.9.7a-2

References (21)