OpenSSL dtls1_retrieve_buffered_fragment()函数握手消息拒绝服务漏洞

BUGTRAQ ID: 35417 CVECAN ID: CVE-2009-1387 OpenSSL是一种开放源码的SSL实现，用来实现网络通信的高强度加密，现在被广泛地用于各种网络应用程序中。 OpenSSL在接收到带有非预期序列号的握手消息时会将其传送给dtls1processoutofseqmessage函数。如果序列号低于预期值，这个函数会丢弃数据；如果为之后的消息，函数会缓冲数据。在丢弃数据时，消息碎片长度保持为0，说明没有缓冲任何数据。由于检查长度所用的错误if条件，有时会缓冲没有数据但长度为丢弃消息长度的碎片，之后在进行处理的时候会导致总线错误。 OpenSSL 0.9.x...

CVE-2009-1387

The dtls1retrievebufferedfragment function in ssl/d1both.c in OpenSSL before 1.0.0 Beta 2 allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via an out-of-sequence DTLS handshake message, related to a "fragment bug."...

Design/Logic Flaw

Use-after-free vulnerability in the dtls1retrievebufferedfragment function in ssl/d1both.c in OpenSSL 1.0.0 Beta 2 allows remote attackers to cause a denial of service openssl sclient crash and possibly have unspecified other impact via a DTLS packet, as demonstrated by a packet from a server tha...

CVE-2009-1379

Use-after-free vulnerability in the dtls1retrievebufferedfragment function in ssl/d1both.c in OpenSSL 1.0.0 Beta 2 allows remote attackers to cause a denial of service openssl sclient crash and possibly have unspecified other impact via a DTLS packet, as demonstrated by a packet from a server tha...