CVE-2009-0590

openssl: ASN1 printing crash

Severity Score

5.0

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The ASN1_STRING_print_ex function in OpenSSL before 0.9.8k allows remote attackers to cause a denial of service (invalid memory access and application crash) via vectors that trigger printing of a (1) BMPString or (2) UniversalString with an invalid encoded length.

La función ASN1_STRING_print_ex en OpenSSL versiones anteriores a v0.9.8k permite a atacantes remotos provocar una denegación de servicio (acceso inválido a memoria y caída de la aplicación) mediante vectores que provocan la impresión de (1) BMPString o (2) UniversalString con una longitud de codificación inválida.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

Attack Vector

Network

Attack Complexity

High

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2009-02-13 CVE Reserved
2009-03-25 CVE Published
2024-03-03 EPSS Updated
2024-08-07 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

CAPEC

References (55)

URL	Tag	Source
http://lists.vmware.com/pipermail/security-announce/2010/000082.html	Mailing List
http://secunia.com/advisories/34411	Third Party Advisory
http://secunia.com/advisories/34460	Third Party Advisory
http://secunia.com/advisories/34509	Third Party Advisory
http://secunia.com/advisories/34561	Third Party Advisory
http://secunia.com/advisories/34666	Third Party Advisory
http://secunia.com/advisories/34896	Third Party Advisory
http://secunia.com/advisories/34960	Third Party Advisory
http://secunia.com/advisories/35065	Third Party Advisory
http://secunia.com/advisories/35181	Third Party Advisory
http://secunia.com/advisories/35380	Third Party Advisory
http://secunia.com/advisories/35729	Third Party Advisory
http://secunia.com/advisories/36533	Third Party Advisory
http://secunia.com/advisories/36701	Third Party Advisory
http://secunia.com/advisories/38794	Third Party Advisory
http://secunia.com/advisories/38834	Third Party Advisory
http://secunia.com/advisories/42467	Third Party Advisory
http://secunia.com/advisories/42724	Third Party Advisory
http://secunia.com/advisories/42733	Third Party Advisory
http://securitytracker.com/id?1021905	Third Party Advisory
http://support.apple.com/kb/HT3865	Third Party Advisory
http://support.avaya.com/elmodocs2/security/ASA-2009-172.htm	Third Party Advisory
http://voodoo-circle.sourceforge.net/sa/sa-20090326-01.html	Third Party Advisory
http://wiki.rpath.com/Advisories:rPSA-2009-0057	Broken Link
http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0057	Broken Link
http://www.osvdb.org/52864	Broken Link
http://www.php.net/archive/2009.php#id2009-04-08-1	Third Party Advisory
http://www.securityfocus.com/archive/1/502429/100/0/threaded	Mailing List
http://www.securityfocus.com/archive/1/515055/100/0/threaded	Mailing List
http://www.vmware.com/security/advisories/VMSA-2010-0019.html	Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/49431	Third Party Advisory
https://kb.bluecoat.com/index?page=content&id=SA50	Third Party Advisory
https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000101.html	Mailing List
https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000102.html	Mailing List
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10198	Signature
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6996	Signature

URL	Date	SRC

URL	Date	SRC
http://sourceforge.net/project/shownotes.php?release_id=671059&group_id=116847	2020-11-03
http://www.securityfocus.com/bid/34256	2020-11-03

URL	Date	SRC
ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-008.txt.asc	2020-11-03
http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html	2020-11-03
http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html	2020-11-03
http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00013.html	2020-11-03
http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00014.html	2020-11-03
http://marc.info/?l=bugtraq&m=124464882609472&w=2	2020-11-03
http://marc.info/?l=bugtraq&m=125017764422557&w=2	2020-11-03
http://marc.info/?l=bugtraq&m=127678688104458&w=2	2020-11-03
http://security.FreeBSD.org/advisories/FreeBSD-SA-09:08.openssl.asc	2020-11-03
http://sunsolve.sun.com/search/document.do?assetkey=1-26-258048-1	2020-11-03
http://www.debian.org/security/2009/dsa-1763	2020-11-03
http://www.mandriva.com/security/advisories?name=MDVSA-2009:087	2020-11-03
http://www.openssl.org/news/secadv_20090325.txt	2020-11-03
http://www.redhat.com/support/errata/RHSA-2009-1335.html	2020-11-03
http://www.ubuntu.com/usn/usn-750-1	2020-11-03
https://access.redhat.com/security/cve/CVE-2009-0590	2010-03-25
https://bugzilla.redhat.com/show_bug.cgi?id=492304	2010-03-25

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Openssl Search vendor "Openssl"		Openssl Search vendor "Openssl" for product "Openssl"				< 0.9.8k Search vendor "Openssl" for product "Openssl" and version " < 0.9.8k"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				4.0 Search vendor "Debian" for product "Debian Linux" and version "4.0"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				5.0 Search vendor "Debian" for product "Debian Linux" and version "5.0"		-		Affected