The kssl_keytab_is_available function in ssl/kssl.c in OpenSSL prior to 0.9.8n, when Kerberos is enabled but Kerberos configuration files cannot be opened, does not check a certain return value, which allows remote malicious users to cause a denial of service (NULL pointer dereference and daemon crash) via SSL cipher negotiation, as demonstrated by a chroot installation of Dovecot or stunnel without Kerberos configuration files inside the chroot.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
openssl openssl 0.9.8b |
||
openssl openssl 0.9.8c |
||
openssl openssl 0.9.8e |
||
openssl openssl |
||
openssl openssl 0.9.8g |
||
openssl openssl 0.9.8k |
||
openssl openssl 0.9.8d |
||
openssl openssl 0.9.8j |
||
openssl openssl 0.9.8l |
||
openssl openssl 0.9.8a |
||
openssl openssl 0.9.8 |
||
openssl openssl 0.9.8i |
||
openssl openssl 0.9.8f |
||
openssl openssl 0.9.8h |
Vulmon