CVE-2009-0789: Medium severity OpenSSL OpenSSL vulnerability

Q: What is the severity of CVE-2009-0789?

CVE-2009-0789 is considered a high severity vulnerability as it can lead to denial of service and application crashes.

Q: How do I fix CVE-2009-0789?

To fix CVE-2009-0789, upgrade OpenSSL to a version that is 0.9.8k or later.

Q: Who is affected by CVE-2009-0789?

CVE-2009-0789 affects OpenSSL versions prior to 0.9.8k on various platforms including WIN64.

Q: What types of attacks can exploit CVE-2009-0789?

CVE-2009-0789 can be exploited through malformed ASN.1 structures in public keys, causing memory access violations.

Q: What are the potential consequences of CVE-2009-0789?

The consequences of CVE-2009-0789 include crashes of applications utilizing affected OpenSSL versions, leading to service disruptions.

Published Mar 27, 2009

Updated

OpenSSL before 0.9.8k on WIN64 and certain other platforms does not properly handle a malformed ASN.1 structure, which allows remote attackers to cause a denial of service (invalid memory access and application crash) by placing this structure in the public key of a certificate, as demonstrated by an RSA public key.

Affected Software

62 affected components

OpenSSL OpenSSL=0.9.7-beta5

OpenSSL OpenSSL=0.9.7-beta3

OpenSSL OpenSSL=0.9.5a-beta2

OpenSSL OpenSSL=0.9.7-beta6

OpenSSL OpenSSL=0.9.8b

OpenSSL OpenSSL=0.9.7l

OpenSSL OpenSSL=0.9.6i

OpenSSL OpenSSL=0.9.3

OpenSSL OpenSSL=0.9.8c

OpenSSL OpenSSL=0.9.7-beta2

OpenSSL OpenSSL=0.9.7c

OpenSSL OpenSSL=0.9.5-beta1

OpenSSL OpenSSL=0.9.6d

OpenSSL OpenSSL=0.9.1c

OpenSSL OpenSSL=0.9.6

OpenSSL OpenSSL=0.9.7j

OpenSSL OpenSSL=0.9.6a

OpenSSL OpenSSL=0.9.8e

OpenSSL OpenSSL=0.9.4

OpenSSL OpenSSL=0.9.8g

OpenSSL OpenSSL=0.9.6a-beta2

OpenSSL OpenSSL=0.9.8d

OpenSSL OpenSSL=0.9.5a

OpenSSL OpenSSL=0.9.6f

OpenSSL OpenSSL=0.9.6-beta3

OpenSSL OpenSSL=0.9.6l

OpenSSL OpenSSL=0.9.7k

OpenSSL OpenSSL=0.9.7g

OpenSSL OpenSSL=0.9.6e

OpenSSL OpenSSL=0.9.7d

OpenSSL OpenSSL=0.9.7

OpenSSL OpenSSL=0.9.6b

OpenSSL OpenSSL=0.9.7e

OpenSSL OpenSSL=0.9.7b

OpenSSL OpenSSL=0.9.6a-beta1

OpenSSL OpenSSL=0.9.6k

OpenSSL OpenSSL=0.9.8a

OpenSSL OpenSSL=0.9.6g

OpenSSL OpenSSL=0.9.6-beta2

OpenSSL OpenSSL=0.9.7m

OpenSSL OpenSSL=0.9.7-beta4

OpenSSL OpenSSL=0.9.3a

OpenSSL OpenSSL=0.9.6h

OpenSSL OpenSSL=0.9.7-beta1

OpenSSL OpenSSL=0.9.7i

OpenSSL OpenSSL=0.9.7h

OpenSSL OpenSSL=0.9.6j

OpenSSL OpenSSL=0.9.8

OpenSSL OpenSSL=0.9.7a

OpenSSL OpenSSL=0.9.6c

OpenSSL OpenSSL=0.9.6-beta1

OpenSSL OpenSSL=0.9.6m

OpenSSL OpenSSL=0.9.8i

OpenSSL OpenSSL=0.9.8f

OpenSSL OpenSSL=0.9.5-beta2

OpenSSL OpenSSL<=0.9.8j

OpenSSL OpenSSL=0.9.8h

OpenSSL OpenSSL=0.9.2b

OpenSSL OpenSSL=0.9.5

OpenSSL OpenSSL=0.9.5a-beta1

OpenSSL OpenSSL=0.9.6a-beta3

OpenSSL OpenSSL=0.9.7f

Remediation

Patch Available

http://www.securityfocus.com/bid/34256

Event History

Mar 27, 2009

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Data Sourced

via NVD·04:30 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2009-0789?

CVE-2009-0789 is considered a high severity vulnerability as it can lead to denial of service and application crashes.

How do I fix CVE-2009-0789?