The dtls1_retrieve_buffered_fragment function in ssl/d1_both.c in OpenSSL before 1.0.0 Beta 2 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence DTLS handshake message, related to a fragment bug.
A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Openssl | Openssl | 0.9.8 (including) | 0.9.8m (excluding) |
| Red Hat Enterprise Linux 5 | RedHat | openssl-0:0.9.8e-12.el5 | * |
| Openssl | Ubuntu | dapper | * |
| Openssl | Ubuntu | devel | * |
| Openssl | Ubuntu | hardy | * |
| Openssl | Ubuntu | intrepid | * |
| Openssl | Ubuntu | jaunty | * |