CVE-2008-1678: Medium severity openssl vulnerability
Apache httpd web server's modssl module linked against OpenSSL >= 0.9.8f can leak pre-connection memory when connecting client reports support for a compression algorithm in the initial handshake, causing httpd to run out of memory after certain amount of SSL connections.
Upstream and Ubuntu bug reports: https://issues.apache.org/bugzilla/showbug.cgi?id=44975 https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/224945
Upstream fix: http://svn.apache.org/viewvc?view=rev&revision=654119
Other sources
Memory leak in the zlibstatefulinit function in crypto/comp/czlib.c in libssl in OpenSSL 0.9.8f through 0.9.8h allows remote attackers to cause a denial of service (memory consumption) via multiple calls, as demonstrated by initial SSL client handshakes to the Apache HTTP Server modssl that specify a compression algorithm.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-1678?
CVE-2008-1678 has a severity rating that indicates it can lead to denial of service through memory consumption.
How do I fix CVE-2008-1678?
To fix CVE-2008-1678, upgrade to OpenSSL version 0.9.8i or later.
What software is affected by CVE-2008-1678?
CVE-2008-1678 affects OpenSSL versions 0.9.8f through 0.9.8h and specific versions of Apache HTTP Server mod_ssl.
Can CVE-2008-1678 be exploited remotely?
Yes, CVE-2008-1678 can be exploited remotely through multiple SSL client handshake requests.
Is there a patch available for CVE-2008-1678?
Yes, a patch is available in later versions of OpenSSL to address the vulnerability in CVE-2008-1678.