CVE-2009-4355: Medium severity openssl vulnerability
Memory leak in the zlibstatefulfinish function in crypto/comp/czlib.c in OpenSSL 0.9.8l and earlier and 1.0.0 Beta through Beta 4 allows remote attackers to cause a denial of service (memory consumption) via vectors that trigger incorrect calls to the CRYPTOcleanupallexdata function, as demonstrated by use of SSLv3 and PHP with the Apache HTTP Server, a related issue to CVE-2008-1678.
Other sources
rPath has had a report of a Denial of Service attack which we have reproduced on Red Hat Enterprise Linux 5 with the latest affected components installed.
Description of problem: When the php module is enabled, after apache receives a "graceful" (USR1) signal, every SSLv3 request leaks a significant amount of memory (hundreds of KB).
Version-Release number of selected component (if applicable): rpm -q php httpd modssl openssl php-5.1.6-23.2.el53 httpd-2.2.3-31.el54.2 modssl-2.2.3-31.el54.2 openssl-0.9.8e-12.el5
How reproducible: Reliably
Steps to Reproduce: 1. Install mentioned components 2. service httpd start 3. note that memory utilization is stable for httpd 4. start a request loop: while :; do curl https://localhost/ -3 --insecure >/dev/null 2>&1; done 5. service httpd graceful Actual results: watch memory utilization spike
Expected results: watch memory utilization remain stable
Additional info: rPath's original report of this issue will be available pending coordinated disclosure or decision not to require coordinated disclosure at https://issues.rpath.com/browse/RPL-3157 I am marking this bugzilla report as security-sensitive as well pending this decision about coordinated disclosure.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2009-4355?
CVE-2009-4355 has been classified as a denial of service vulnerability due to memory leaks.
How do I fix CVE-2009-4355?
To fix CVE-2009-4355, it is recommended to upgrade OpenSSL to a version later than 0.9.8l or 1.0.0 Beta 4.
Which versions of OpenSSL are affected by CVE-2009-4355?
CVE-2009-4355 affects OpenSSL versions 0.9.8l and earlier, and 1.0.0 Beta through Beta 4.
What type of attack does CVE-2009-4355 allow?
CVE-2009-4355 allows remote attackers to exploit the vulnerability to cause a denial of service through memory consumption.
Is CVE-2009-4355 a critical vulnerability?
While CVE-2009-4355 is not a critical vulnerability, it can lead to significant service disruptions if exploited.