// For flags

CVE-2009-0590

openssl: ASN1 printing crash

Severity Score

7.5
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The ASN1_STRING_print_ex function in OpenSSL before 0.9.8k allows remote attackers to cause a denial of service (invalid memory access and application crash) via vectors that trigger printing of a (1) BMPString or (2) UniversalString with an invalid encoded length.

La función ASN1_STRING_print_ex en OpenSSL versiones anteriores a v0.9.8k permite a atacantes remotos provocar una denegación de servicio (acceso inválido a memoria y caída de la aplicación) mediante vectores que provocan la impresión de (1) BMPString o (2) UniversalString con una longitud de codificación inválida.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
None
Availability
Partial
Attack Vector
Network
Attack Complexity
High
Authentication
None
Confidentiality
None
Integrity
None
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2009-02-13 CVE Reserved
  • 2009-03-27 CVE Published
  • 2024-08-07 CVE Updated
  • 2025-03-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CAPEC
References (55)
URL Tag Source
http://lists.vmware.com/pipermail/security-announce/2010/000082.html Mailing List
http://secunia.com/advisories/34411 Third Party Advisory
http://secunia.com/advisories/34460 Third Party Advisory
http://secunia.com/advisories/34509 Third Party Advisory
http://secunia.com/advisories/34561 Third Party Advisory
http://secunia.com/advisories/34666 Third Party Advisory
http://secunia.com/advisories/34896 Third Party Advisory
http://secunia.com/advisories/34960 Third Party Advisory
http://secunia.com/advisories/35065 Third Party Advisory
http://secunia.com/advisories/35181 Third Party Advisory
http://secunia.com/advisories/35380 Third Party Advisory
http://secunia.com/advisories/35729 Third Party Advisory
http://secunia.com/advisories/36533 Third Party Advisory
http://secunia.com/advisories/36701 Third Party Advisory
http://secunia.com/advisories/38794 Third Party Advisory
http://secunia.com/advisories/38834 Third Party Advisory
http://secunia.com/advisories/42467 Third Party Advisory
http://secunia.com/advisories/42724 Third Party Advisory
http://secunia.com/advisories/42733 Third Party Advisory
http://securitytracker.com/id?1021905 Third Party Advisory
http://support.apple.com/kb/HT3865 Third Party Advisory
http://support.avaya.com/elmodocs2/security/ASA-2009-172.htm Third Party Advisory
http://voodoo-circle.sourceforge.net/sa/sa-20090326-01.html Third Party Advisory
http://wiki.rpath.com/Advisories:rPSA-2009-0057 Broken Link
http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0057 Broken Link
http://www.osvdb.org/52864 Broken Link
http://www.php.net/archive/2009.php#id2009-04-08-1 Third Party Advisory
http://www.securityfocus.com/archive/1/502429/100/0/threaded Mailing List
http://www.securityfocus.com/archive/1/515055/100/0/threaded Mailing List
http://www.vmware.com/security/advisories/VMSA-2010-0019.html Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/49431 Third Party Advisory
https://kb.bluecoat.com/index?page=content&id=SA50 Third Party Advisory
https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000101.html Mailing List
https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000102.html Mailing List
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10198 Signature
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6996 Signature
URL Date SRC
URL Date SRC
http://sourceforge.net/project/shownotes.php?release_id=671059&group_id=116847 2020-11-03
http://www.securityfocus.com/bid/34256 2020-11-03
URL Date SRC
ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-008.txt.asc 2020-11-03
http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html 2020-11-03
http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html 2020-11-03
http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00013.html 2020-11-03
http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00014.html 2020-11-03
http://marc.info/?l=bugtraq&m=124464882609472&w=2 2020-11-03
http://marc.info/?l=bugtraq&m=125017764422557&w=2 2020-11-03
http://marc.info/?l=bugtraq&m=127678688104458&w=2 2020-11-03
http://security.FreeBSD.org/advisories/FreeBSD-SA-09:08.openssl.asc 2020-11-03
http://sunsolve.sun.com/search/document.do?assetkey=1-26-258048-1 2020-11-03
http://www.debian.org/security/2009/dsa-1763 2020-11-03
http://www.mandriva.com/security/advisories?name=MDVSA-2009:087 2020-11-03
http://www.openssl.org/news/secadv_20090325.txt 2020-11-03
http://www.redhat.com/support/errata/RHSA-2009-1335.html 2020-11-03
http://www.ubuntu.com/usn/usn-750-1 2020-11-03
https://access.redhat.com/security/cve/CVE-2009-0590 2010-03-25
https://bugzilla.redhat.com/show_bug.cgi?id=492304 2010-03-25
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Openssl
Search vendor "Openssl"
 Openssl
Search vendor "Openssl" for product "Openssl"
 < 0.9.8k
Search vendor "Openssl" for product "Openssl" and version " < 0.9.8k"
-
Affected
Debian
Search vendor "Debian"
 Debian Linux
Search vendor "Debian" for product "Debian Linux"
 4.0
Search vendor "Debian" for product "Debian Linux" and version "4.0"
-
Affected
Debian
Search vendor "Debian"
 Debian Linux
Search vendor "Debian" for product "Debian Linux"
 5.0
Search vendor "Debian" for product "Debian Linux" and version "5.0"
-
Affected