CVE-2009-1379 Use after free in n/a
Remote attackers can cause denial of service and potentially execute code via crafted DTLS packets in OpenSSL.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2009-1379?
CVE-2009-1379 is a medium-severity use after free vulnerability in Openssl Openssl, published on 19 May 2009. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Use-after-free vulnerability in the dtls1_retrieve_buffered_fragment function in ssl/d1_both.c in OpenSSL 1.0.0 Beta 2 allows remote attackers to cause a denial of service (openssl s_client crash) and possibly have unspecified other impact via a DTLS packet, as demonstrated by a packet from a server that uses a crafted server certificate.
Weakness: CWE-399
Which versions are affected by CVE-2009-1379?
It affects 1 product.
Products include Openssl Openssl.
How do I fix CVE-2009-1379?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2009-1379 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2009-1379 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Openssl Openssl
Sources
Also known as DEBIAN-CVE-2009-1379, GHSA-4pw3-fcxf-f8gx.