PT-2009-6745 · Mit+1 · Mit-Krb5+2
Published
1970-01-01
·
Updated
2024-06-15
·
CVE-2009-0844
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
krb5 versions 1.5 through 1.6.3
mit-krb5 versions prior to 1.6.3-r6
Description
The issue affects the confidentiality, integrity, and availability of protected information. Exploitation can be done remotely. The get input token function in the SPNEGO implementation allows remote attackers to cause a denial of service and possibly obtain sensitive information via a crafted length value that triggers a buffer over-read.
Recommendations
For krb5 versions 1.5 through 1.6.3, update to a version later than 1.6.3 to resolve the issue.
For mit-krb5 versions prior to 1.6.3-r6, update to version 1.6.3-r6 or later to resolve the issue.
As a temporary workaround, consider restricting access to the SPNEGO implementation until a patch is available.
Fix
DoS
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Red Hat
Krb5
Mit-Krb5