PT-2023-20165 · Unknown+6 · Gss-Ntlmssp+6
Philipturnbull
·
Publicado
2023-02-12
·
Atualizado
2025-06-24
·
CVE-2023-25567
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
GSS-NTLMSSP versions prior to 1.2.0
Description
The issue is an out-of-bounds read that occurs when decoding target information. This happens because the length of the
av pair is not properly checked for two elements, which can trigger an out-of-bounds read. The out-of-bounds read can be triggered via the main gss accept sec context entry point and could cause a denial-of-service if the memory is unmapped.Recommendations
For versions prior to 1.2.0, update to version 1.2.0 to resolve the issue. As a temporary workaround, consider restricting access to the
gss accept sec context entry point to minimize the risk of exploitation.Exploit
Correção
DoS
Out of bounds Read
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Almalinux
Centos
Debian
Gss-Ntlmssp
Linuxmint
Red Hat
Ubuntu