National Cyber Awareness System

Vulnerability Summary for CVE-2009-4355

Overview

Memory leak in the zlib_stateful_finish function in crypto/comp/c_zlib.c in OpenSSL 0.9.8l and earlier and 1.0.0 Beta through Beta 4 allows remote attackers to cause a denial of service (memory consumption) via vectors that trigger incorrect calls to the CRYPTO_cleanup_all_ex_data function, as demonstrated by use of SSLv3 and PHP with the Apache HTTP Server, a related issue to CVE-2008-1678.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: REDHAT

Name: RHSA-2010:0095

Hyperlink:https://rhn.redhat.com/errata/RHSA-2010-0095.html

External Source: CONFIRM

Name: https://kb.bluecoat.com/index?page=content&id=SA50

Hyperlink:https://kb.bluecoat.com/index?page=content&id=SA50

External Source: CONFIRM

Name: https://issues.rpath.com/browse/RPL-3157

Hyperlink:https://issues.rpath.com/browse/RPL-3157

External Source: CONFIRM

Name: https://bugzilla.redhat.com/show_bug.cgi?id=546707

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=546707

External Source: VUPEN

Name: ADV-2010-0916

Hyperlink:http://www.vupen.com/english/advisories/2010/0916

External Source: VUPEN

Name: ADV-2010-0839

Hyperlink:http://www.vupen.com/english/advisories/2010/0839

External Source: VUPEN

Name: ADV-2010-0124

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2010/0124

External Source: UBUNTU

Name: USN-884-1

Type: Advisory

Hyperlink:http://www.ubuntu.com/usn/USN-884-1

External Source: MLIST

Name: [oss-security] 20100113 [PATCH] memory consumption (DoS) in openssl CVE-2009-4355

Hyperlink:http://www.openwall.com/lists/oss-security/2010/01/13/3

External Source: MANDRIVA

Name: MDVSA-2010:022

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2010:022

External Source: DEBIAN

Name: DSA-1970

Hyperlink:http://www.debian.org/security/2010/dsa-1970

External Source: CONFIRM

Name: http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0004

Hyperlink:http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0004

External Source: SLACKWARE

Name: SSA:2010-060-02

Hyperlink:http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.663049

External Source: SECUNIA

Name: 42733

Hyperlink:http://secunia.com/advisories/42733

External Source: SECUNIA

Name: 42724

Hyperlink:http://secunia.com/advisories/42724

External Source: SECUNIA

Name: 39461

Hyperlink:http://secunia.com/advisories/39461

External Source: SECUNIA

Name: 38761

Hyperlink:http://secunia.com/advisories/38761

External Source: SECUNIA

Name: 38200

Type: Advisory

Hyperlink:http://secunia.com/advisories/38200

External Source: SECUNIA

Name: 38181

Type: Advisory

Hyperlink:http://secunia.com/advisories/38181

External Source: SECUNIA

Name: 38175

Type: Advisory

Hyperlink:http://secunia.com/advisories/38175

External Source: OVAL

Name: oval:org.mitre.oval:def:6678

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:6678

External Source: OVAL

Name: oval:org.mitre.oval:def:12168

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:12168

External Source: OVAL

Name: oval:org.mitre.oval:def:11260

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:11260

External Source: SUSE

Name: SUSE-SA:2010:008

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html

External Source: FEDORA

Name: FEDORA-2010-5357

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039561.html

External Source: FEDORA

Name: FEDORA-2010-5744

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038587.html

External Source: CONFIRM

Name: http://cvs.openssl.org/chngview?cn=19167

Hyperlink:http://cvs.openssl.org/chngview?cn=19167

External Source: CONFIRM

Name: http://cvs.openssl.org/chngview?cn=19069

Hyperlink:http://cvs.openssl.org/chngview?cn=19069

External Source: CONFIRM

Name: http://cvs.openssl.org/chngview?cn=19068

Hyperlink:http://cvs.openssl.org/chngview?cn=19068

References to Check Content

Identifier:oval:org.mitre.oval:def:6678

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:6678

Identifier:oval:org.mitre.oval:def:11260

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:11260

Identifier:oval:org.mitre.oval:def:12168

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:12168