CVE-2009-1378

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 12.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-05-19 · updated 2026-06-16
Weakness: CWE-401

Description

Multiple memory leaks in the dtls1_process_out_of_seq_message function in ssl/d1_both.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allow remote attackers to cause a denial of service (memory consumption) via DTLS records that (1) are duplicates or (2) have sequence numbers much greater than current sequence numbers, aka "DTLS fragment handling memory leak."

Affected products

Canonical Ubuntu Linux: 6.06, 8.04, 8.10, 9.04
OpenSSL: from 0.9.8 (excl.) before 0.9.8m — fixed in 0.9.8m

How to fix

Upgrade to a fixed version: OpenSSL 0.9.8m. Check the vendor advisory for mitigations.

References

http://cvs.openssl.org/chngview?cn=18188
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02029444
http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html
http://lists.vmware.com/pipermail/security-announce/2010/000082.html
http://marc.info/?l=openssl-dev&m=124247679213944&w=2
http://marc.info/?l=openssl-dev&m=124263491424212&w=2
http://rt.openssl.org/Ticket/Display.html?id=1931&user=guest&pass=guest
http://secunia.com/advisories/35128
http://secunia.com/advisories/35416
http://secunia.com/advisories/35461
http://secunia.com/advisories/35571

Get alerted when CVE-2009-1378 or the next vulnerability affects your stack