Secure testing team - May 2009 - Bug#530400: CVE-2009-137{7,8,9}

Package: openssl
Severity: serious
Tags: security patch

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Hi,
the following CVE (Common Vulnerabilities & Exposures) ids were
published for openssl.

CVE-2009-1377[0]:
| The dtls1_buffer_record function in ssl/d1_pkt.c in OpenSSL 0.9.8k and
| earlier 0.9.8 versions allows remote attackers to cause a denial of
| service (memory consumption) via a large series of "future epoch"
DTLS
| records that are buffered in a queue, aka "DTLS record buffer
| limitation bug."

CVE-2009-1378[1]:
| Multiple memory leaks in the dtls1_process_out_of_seq_message function
| in ssl/d1_both.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allow
| remote attackers to cause a denial of service (memory consumption) via
| DTLS records that (1) are duplicates or (2) have sequence numbers much
| greater than current sequence numbers, aka "DTLS fragment handling
| memory leak."

CVE-2009-1379[2]:
| Use-after-free vulnerability in the dtls1_retrieve_buffered_fragment
| function in ssl/d1_both.c in OpenSSL 1.0.0 Beta 2 allows remote
| attackers to cause a denial of service (openssl s_client crash) and
| possibly have unspecified other impact via a DTLS packet, as
| demonstrated by a packet from a server that uses a crafted server
| certificate.

If you fix the vulnerabilities please also make sure to include the
CVE ids in your changelog entry.

For further information see:

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1377
    http://security-tracker.debian.net/tracker/CVE-2009-1377
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1378
    http://security-tracker.debian.net/tracker/CVE-2009-1378
[2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1379
    http://security-tracker.debian.net/tracker/CVE-2009-1379

Patches:
   http://cvs.openssl.org/chngview?cn=18187
   http://cvs.openssl.org/chngview?cn=18188
   http://marc.info/?l=openssl-dev&m=124202891602690&w=2 (not committed
in upstream cvs repository)

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAkoZcvgACgkQNxpp46476apLNgCdEM7aDLJ/IyonSmBLtdLv6sE0
4m4An2MX1eG9vaDK9OKR188IkshIkqvR
=2FSH
-----END PGP SIGNATURE-----