CVE-2009-1387: Null Pointer Dereference
The dtls1retrievebufferedfragment function in ssl/d1both.c in OpenSSL before 1.0.0 Beta 2 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence DTLS handshake message, related to a "fragment bug."
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-1387?
CVE-2009-1387 has a severity rating that indicates it can lead to a denial of service, causing application crashes.
How do I fix CVE-2009-1387?
To fix CVE-2009-1387, upgrade to a version of OpenSSL after 1.0.0 Beta 2.
What is the impact of CVE-2009-1387?
CVE-2009-1387 can be exploited by remote attackers to crash the OpenSSL daemon through a NULL pointer dereference.
Which versions of OpenSSL are affected by CVE-2009-1387?
CVE-2009-1387 affects OpenSSL versions before 1.0.0 Beta 2, as well as some specific older versions.
Is CVE-2009-1387 targeted at specific operating systems?
CVE-2009-1387 impacts multiple operating systems where vulnerable versions of OpenSSL are deployed, including older versions of Ubuntu and Red Hat.