Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
10
CVSSv2

CVE-2009-0846

Published: 09/04/2009 Updated: 09/02/2024
CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10
VMScore: 890
Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Subscribe to Kerberos 5

Vulnerability Summary

The asn1_decode_generaltime function in lib/krb5/asn.1/asn1_decode.c in the ASN.1 GeneralizedTime decoder in MIT Kerberos 5 (aka krb5) prior to 1.6.4 allows remote malicious users to cause a denial of service (daemon crash) or possibly execute arbitrary code via vectors involving an invalid DER encoding that triggers a free of an uninitialized pointer.

Vulnerable Product Search on Vulmon Subscribe to Product

mit kerberos 5

fedoraproject fedora 10

fedoraproject fedora 9

canonical ubuntu linux 7.10

canonical ubuntu linux 8.10

canonical ubuntu linux 8.04

canonical ubuntu linux 6.06

apple mac os x

redhat enterprise linux 4.0

redhat enterprise linux desktop 3.0

redhat enterprise linux desktop 4.0

redhat enterprise linux eus 4.7

redhat enterprise linux server 4.0

redhat enterprise linux workstation 4.0

redhat enterprise linux workstation 3.0

redhat enterprise linux server 3.0

redhat enterprise linux server 2.0

redhat enterprise linux workstation 2.0

Vendor Advisories

Ubuntu Security Notice: krb5 vulnerabilities
Multiple flaws were discovered in the Kerberos GSS-API and ASN1 routines that did not correctly handle certain requests An unauthenticated remote attacker could send specially crafted traffic to crash services using the Kerberos library, leading to a denial of service ...
Debian Security Advisories: DSA-1766-1 krb5 -- several vulnerabilities
Several vulnerabilities have been found in the MIT reference implementation of Kerberos V5, a system for authenticating users and services on a network The Common Vulnerabilities and Exposures project identified the following problems: CVE-2009-0844 The Apple Product Security team discovered that the SPNEGO GSS-API mechanism suffers of a missing ...
Red Hat: Critical: krb5 security update
Synopsis Critical: krb5 security update Type/Severity Security Advisory: Critical Topic Updated krb5 packages that fix a security issue are now available for RedHat Enterprise Linux 21 and 3This update has been rated as having critical security impact by the RedHat Security Response Team Descrip ...
Red Hat: Important: krb5 security update
Synopsis Important: krb5 security update Type/Severity Security Advisory: Important Topic Updated krb5 packages that fix a security issue are now available for RedHat Enterprise Linux 4This update has been rated as having important security impact by the RedHat Security Response Team Description ...
Red Hat: Important: krb5 security update
Synopsis Important: krb5 security update Type/Severity Security Advisory: Important Topic Updated krb5 packages that fix various security issues are now availablefor Red Hat Enterprise Linux 5This update has been rated as having important security impact by the RedHat Security Response Team Descr ...

References

CWE-824http://www.kb.cert.org/vuls/id/662091http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2009-002.txthttp://www.securitytracker.com/id?1021994http://www.ubuntu.com/usn/usn-755-1http://secunia.com/advisories/34640http://security.gentoo.org/glsa/glsa-200904-09.xmlhttp://wiki.rpath.com/Advisories:rPSA-2009-0058http://www.vupen.com/english/advisories/2009/0976http://www.vupen.com/english/advisories/2009/0960http://www.securityfocus.com/bid/34409https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00206.htmlhttp://secunia.com/advisories/34630http://secunia.com/advisories/34594http://secunia.com/advisories/34622http://secunia.com/advisories/34637https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00205.htmlhttp://www.redhat.com/support/errata/RHSA-2009-0408.htmlhttp://secunia.com/advisories/34617http://rhn.redhat.com/errata/RHSA-2009-0410.htmlhttp://secunia.com/advisories/34598http://rhn.redhat.com/errata/RHSA-2009-0409.htmlhttp://wiki.rpath.com/wiki/Advisories:rPSA-2009-0058http://secunia.com/advisories/34628http://support.avaya.com/elmodocs2/security/ASA-2009-142.htmhttp://www.vupen.com/english/advisories/2009/1106http://sunsolve.sun.com/search/document.do?assetkey=1-26-256728-1http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5047180.htmlhttp://www.vupen.com/english/advisories/2009/1057http://secunia.com/advisories/34734http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5047181.htmlhttp://www.us-cert.gov/cas/techalerts/TA09-133A.htmlhttp://support.apple.com/kb/HT3549http://www.vupen.com/english/advisories/2009/1297http://secunia.com/advisories/35074http://lists.apple.com/archives/security-announce/2009/May/msg00002.htmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2009:098http://lists.vmware.com/pipermail/security-announce/2009/000059.htmlhttp://www.vmware.com/security/advisories/VMSA-2009-0008.htmlhttp://secunia.com/advisories/35667http://www.vupen.com/english/advisories/2009/2084http://marc.info/?l=bugtraq&m=124896429301168&w=2http://www-01.ibm.com/support/docview.wss?uid=swg21396120http://www.vupen.com/english/advisories/2009/2248http://marc.info/?l=bugtraq&m=130497213107107&w=2https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6301https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5483https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10694http://www.securityfocus.com/archive/1/504683/100/0/threadedhttp://www.securityfocus.com/archive/1/502546/100/0/threadedhttp://www.securityfocus.com/archive/1/502527/100/0/threadedhttps://usn.ubuntu.com/755-1/https://nvd.nist.gov
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2023-3675CVE-2024-3400CVE-2024-23557mass assignmentCVE-2023-1389local file inclusionCVE-2024-32596file uploadCVE-2024-32593
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook