PT-2023-20165 · Unknown+6 · Gss-Ntlmssp+6
Philipturnbull
·
Published
2023-02-12
·
Updated
2025-06-24
·
CVE-2023-25567
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
GSS-NTLMSSP versions prior to 1.2.0
Description
The issue is an out-of-bounds read that occurs when decoding target information. This happens because the length of the
av pair is not properly checked for two elements, which can trigger an out-of-bounds read. The out-of-bounds read can be triggered via the main gss accept sec context entry point and could cause a denial-of-service if the memory is unmapped.Recommendations
For versions prior to 1.2.0, update to version 1.2.0 to resolve the issue. As a temporary workaround, consider restricting access to the
gss accept sec context entry point to minimize the risk of exploitation.Exploit
Fix
DoS
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Almalinux
Centos
Debian
Gss-Ntlmssp
Linuxmint
Red Hat
Ubuntu