[Pkg-openssl-changes] r394 - in openssl/branches/lenny: debian ssl
Kurt Roeckx
kroeckx at alioth.debian.org
Mon Jun 1 12:51:55 UTC 2009
Author: kroeckx
Date: 2009-06-01 12:51:55 +0000 (Mon, 01 Jun 2009)
New Revision: 394
Modified:
openssl/branches/lenny/debian/changelog
openssl/branches/lenny/ssl/d1_both.c
Log:
Fix "DTLS fragment handling" (CVE-2009-1378)
Modified: openssl/branches/lenny/debian/changelog
===================================================================
--- openssl/branches/lenny/debian/changelog 2009-06-01 12:40:43 UTC (rev 393)
+++ openssl/branches/lenny/debian/changelog 2009-06-01 12:51:55 UTC (rev 394)
@@ -1,8 +1,9 @@
openssl (0.9.8g-15+lenny2) stable-security; urgency=low
* Fix "DTLS record buffer limitation bug." (CVE-2009-1377)
+ * Fix "DTLS fragment handling" (CVE-2009-1378)
- -- Kurt Roeckx <kurt at roeckx.be> Mon, 01 Jun 2009 14:34:45 +0200
+ -- Kurt Roeckx <kurt at roeckx.be> Mon, 01 Jun 2009 14:39:43 +0200
openssl (0.9.8g-15+lenny1) stable-security; urgency=low
Modified: openssl/branches/lenny/ssl/d1_both.c
===================================================================
--- openssl/branches/lenny/ssl/d1_both.c 2009-06-01 12:40:43 UTC (rev 393)
+++ openssl/branches/lenny/ssl/d1_both.c 2009-06-01 12:51:55 UTC (rev 394)
@@ -561,7 +561,16 @@
if ((msg_hdr->frag_off+frag_len) > msg_hdr->msg_len)
goto err;
- if (msg_hdr->seq <= s->d1->handshake_read_seq)
+ /* Try to find item in queue, to prevent duplicate entries */
+ memset(seq64be,0,sizeof(seq64be));
+ seq64be[6] = (unsigned char) (msg_hdr->seq>>8);
+ seq64be[7] = (unsigned char) msg_hdr->seq;
+ item = pqueue_find(s->d1->buffered_messages, seq64be);
+
+ /* Discard the message if sequence number was already there, is
+ * too far in the future or the fragment is already in the queue */
+ if (msg_hdr->seq <= s->d1->handshake_read_seq ||
+ msg_hdr->seq > s->d1->handshake_read_seq + 10 || item != NULL)
{
unsigned char devnull [256];
More information about the Pkg-openssl-changes
mailing list