Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 18 May 2009 09:32:04 +0100 (BST)
From: Mark J Cox <>
Subject: Two OpenSSL DTLS remote DoS

Spotted on openssl-dev, two issues that can lead to a remote attacker 
exhausting memory of a DTLS enabled service.  DTLS support was introduced 
in OpenSSL 0.9.8.

CVE-2009-1377 DTLS epoch record buffer memory DoS

 	CVSSv2= 5.0/AV:N/AC:L/Au:N/C:N/I:N/A:P

CVE-2009-1378 DTLS fragment handling memory DoS
 	(Note doesn't have a backported 0.9.8 patch yet, follow openssl-dev)

 	CVSSv2= 5.0/AV:N/AC:L/Au:N/C:N/I:N/A:P

Thanks, Mark

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ