Explain CVE-2008-1678
Memory leak in the zlib_stateful_init function in crypto/comp/c_zlib.c in libssl in OpenSSL 0.9.8f through 0.9.8h allows remote attackers to cause a denial of service (memory consumption) via multiple calls, as demonstrated by initial SSL client handshakes to the Apache HTTP Server mod_ssl that specify a compression algorithm.
Affected Products: n/a
References: [{'name': 'RHSA-2009:1075', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2009-1075.html'}, {'name': '42724', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/42724'}, {'name': '34219', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34219'}, {'name': 'openssl-libssl-dos(43948)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/43948'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=447268'}, {'name': '31026', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/31026'}, {'name': 'SSA:2010-060-02', 'tags': ['vendor-advisory', 'x_refsource_SLACKWARE'], 'url': 'http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.663049'}, {'name': '31692', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/31692'}, {'name': 'SUSE-SR:2008:024', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00000.html'}, {'name': 'oval:org.mitre.oval:def:9754', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9754'}, {'name': '31681', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/31681'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://issues.apache.org/bugzilla/show_bug.cgi?id=44975'}, {'name': '38761', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38761'}, {'name': '31416', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/31416'}, {'name': '44183', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/44183'}, {'name': 'USN-731-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-731-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.gentoo.org/show_bug.cgi?id=222643'}, {'name': '32222', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/32222'}, {'name': '35264', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35264'}, {'name': 'MDVSA-2009:124', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2009:124'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://svn.apache.org/viewvc?view=rev&revision=654119'}, {'name': 'FEDORA-2008-6393', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00055.html'}, {'name': 'GLSA-200807-06', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200807-06.xml'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.edge.launchpad.net/bugs/224945'}, {'name': 'ADV-2008-2780', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/2780'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.edge.launchpad.net/bugs/186339'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://kb.bluecoat.com/index?page=content&id=SA50'}, {'name': '3981', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3981'}, {'name': '[openssl-dev] 20080512 possible memory leak in zlib compression', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://marc.info/?l=openssl-dev&m=121060672602371&w=2'}, {'name': 'APPLE-SA-2008-10-09', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT3216'}, {'name': '42733', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/42733'}]
CVE State: PUBLISHED