CVE-2009-1386: Null Pointer Dereference
Published Jun 4, 2009
·Updated
ssl/s3pkt.c in OpenSSL before 0.9.8i allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a DTLS ChangeCipherSpec packet that occurs before ClientHello.
Affected Software
18 affected components
OpenSSL OpenSSL=0.9.8b
OpenSSL OpenSSL=0.9.8c
OpenSSL OpenSSL=0.9.8e
OpenSSL OpenSSL=0.9.8g
OpenSSL OpenSSL=0.9.8d
OpenSSL OpenSSL=0.9.8a
OpenSSL OpenSSL=0.9.8f
OpenSSL OpenSSL=0.9.8h
OpenSSL OpenSSL<0.9.8
OpenSSL OpenSSL=0.9.8
redhat Openssl=0.9.6-15
redhat Openssl=0.9.6b-3
redhat Openssl=0.9.7a-2
Canonical Ubuntu Linux=9.04
Canonical Ubuntu Linux=8.10
Canonical Ubuntu Linux=8.04
Canonical Ubuntu Linux=6.06
OpenSSL OpenSSL>0.9.8<0.9.8i
Remediation
Patch Available
Event History
Jun 4, 2009
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2009-1386?
CVE-2009-1386 has a severity rating that indicates it can lead to a denial of service through a NULL pointer dereference.
2
How do I fix CVE-2009-1386?
To fix CVE-2009-1386, upgrade OpenSSL to version 0.9.8i or later.
3
Which versions of OpenSSL are affected by CVE-2009-1386?
CVE-2009-1386 affects all versions of OpenSSL before 0.9.8i, including various Red Hat and Ubuntu releases.
4
What happens if I do not address CVE-2009-1386?
If CVE-2009-1386 is not addressed, your system may become vulnerable to remote attackers causing service interruptions.
5
Is CVE-2009-1386 related to DTLS protocol?
Yes, CVE-2009-1386 is specifically associated with a vulnerability in handling DTLS ChangeCipherSpec packets.