VRDA Feed by JPCERT/CC
  Vulnerability Response Decision Assistance Feed : Information for vulnerability impact analysis
[ about VRDA Feed | JPCERT/CC ] 



 
Vulnerability Analysis Result (Revision No : 1) [ Download XML ] 
VRDA-100118-001
OpenSSL "CRYPTO_free_all_ex_data()" Memory Leak Vulnerability
http://cvs.openssl.org/chngview?cn=19068

Modify compression code so it frees up structures without using the ex_data callbacks. This works around a problem where some applications call CRYPTO_free_all_ex_data() before application exit (e.g. when restarting) then use compression (e.g. SSL with compression) later. This results in significant per-connection memory leaks and has caused some security issues including CVE-2008-1678 and CVE-2009-4355.




About This Analysis Information
Analysis Information Provider:
 		JPCERT/CC
 		First Published:
 		2010-01-18
Source Information Category:
 		Advisory, Alert
 		Last Updated:
 		2010-01-18




Affected Product Tags
cpe:/a:openssl:openssl     (OpenSSL Project OpenSSL)
 


Vulnerability Analysis Results
[Information Source Reliability] [?]
Low [?]

Medium [?]
X High [?]
[Impact Level] [?]
Low [?]

X Low-Medium [?]
Medium-High [?]
High [?]
[Access Required] [?]
Physical [?]

Local [?]
Non-routed [?]
X Routed [?]
[Authentication] [?]
Privileged [?]

Standard [?]
Limited [?]
X None or Unnecessary [?]
[User Interaction Required] [?]
X Complex [?]

Simple [?]
None [?]
[Technical Difficulty] [?]
High [?]

Medium-High [?]
Low-Medium [?]
Low [?]
[Availability of Remediation] [?]
Official Patch [?]

X Official Workaround [?]
Unofficial Patch [?]
None [?]
[Incident Activity] [?]
X None [?]

Exploit or PoC [?]
Activity Observed [?]
Alternatives




References
Common Vulnerabilities and Exposures (CVE) CVE-2009-4355
Memory leak in the zlib_stateful_finish function incrypto/comp/c_zlib.c in OpenSSL 0.9.8l and earlier and 1.0.0 Betathrough Beta 4 allows remote attackers to cause a denial of service(memory consumption) via vectors that trigger incorrect calls to theCRYPTO_free_all_ex_data function, as demonstrated by use of SSLv3 andPHP with the Apache HTTP Server, a related issue to CVE-2008-1678.




Copyright © 2010 JPCERT/CC All Rights Reserved.