CVE-2004-0112 The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote att...
MediumCVSS 5.0
EPSS 10.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that causes an out-of-bounds read.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco firewall services module | All versions | No fix listed |
| cisco firewall services module | = 1.1.2 | No fix listed |
| cisco firewall services module | = 1.1.3 | No fix listed |
| cisco firewall services module | = 1.1_(3.005) | No fix listed |
| cisco firewall services module | = 2.1_(0.208) | No fix listed |
| HP Inc aaa server | All versions | No fix listed |
| HP Inc apache-based web server | = 2.0.43.00 | No fix listed |
| HP Inc apache-based web server | = 2.0.43.04 | No fix listed |
| symantec clientless vpn gateway 4400 | = 5.0 | No fix listed |
| ciscoworks common management foundation | = 2.1 | No fix listed |
| ciscoworks common services | = 2.2 | No fix listed |
| avaya converged communications server | = 2.0 | No fix listed |
| avaya sg200 | = 4.4 | No fix listed |
| avaya sg200 | = 4.31.29 | No fix listed |
| avaya sg203 | = 4.4 | No fix listed |
| avaya sg203 | = 4.31.29 | No fix listed |
| avaya sg208 | All versions | No fix listed |
| avaya sg208 | = 4.4 | No fix listed |
| avaya sg5 | = 4.2 | No fix listed |
| avaya sg5 | = 4.3 | No fix listed |
| avaya sg5 | = 4.4 | No fix listed |
| apple mac os x | = 10.3.3 | No fix listed |
| apple mac os x server | = 10.3.3 | No fix listed |
| freebsd | = 4.8 | No fix listed |
| freebsd | = 4.8-releng | No fix listed |
Show 175 more
| Product | Affected versions | Fixed in |
|---|---|---|
| freebsd | = 4.9 | No fix listed |
| freebsd | = 5.1 | No fix listed |
| freebsd | = 5.1-release | No fix listed |
| freebsd | = 5.1-releng | No fix listed |
| freebsd | = 5.2 | No fix listed |
| freebsd | = 5.2.1-release | No fix listed |
| HP Inc hp-ux | = 8.05 | No fix listed |
| HP Inc hp-ux | = 11.00 | No fix listed |
| HP Inc hp-ux | = 11.11 | No fix listed |
| HP Inc hp-ux | = 11.23 | No fix listed |
| OpenBSD | = 3.3 | No fix listed |
| OpenBSD | = 3.4 | No fix listed |
| redhat enterprise linux | = 3.0 | No fix listed |
| redhat enterprise linux desktop | = 3.0 | No fix listed |
| redhat linux | = 7.2 | No fix listed |
| redhat linux | = 7.3 | No fix listed |
| redhat linux | = 8.0 | No fix listed |
| sco openserver | = 5.0.6 | No fix listed |
| sco openserver | = 5.0.7 | No fix listed |
| cisco ios | = 12.1(11)e | No fix listed |
| cisco ios | = 12.1(11b)e | No fix listed |
| cisco ios | = 12.1(11b)e12 | No fix listed |
| cisco ios | = 12.1(11b)e14 | No fix listed |
| cisco ios | = 12.1(13)e9 | No fix listed |
| cisco ios | = 12.1(19)e1 | No fix listed |
| cisco ios | = 12.2(14)sy | No fix listed |
| cisco ios | = 12.2(14)sy1 | No fix listed |
| cisco ios | = 12.2sy | No fix listed |
| cisco ios | = 12.2za | No fix listed |
| 4d webstar | = 4.0 | No fix listed |
| 4d webstar | = 5.2 | No fix listed |
| 4d webstar | = 5.2.1 | No fix listed |
| 4d webstar | = 5.2.2 | No fix listed |
| 4d webstar | = 5.2.3 | No fix listed |
| 4d webstar | = 5.2.4 | No fix listed |
| 4d webstar | = 5.3 | No fix listed |
| 4d webstar | = 5.3.1 | No fix listed |
| avaya intuity audix | All versions | No fix listed |
| avaya intuity audix | = 5.1.46 | No fix listed |
| avaya intuity audix | = s3210 | No fix listed |
| avaya intuity audix | = s3400 | No fix listed |
| avaya vsu | = 5 | No fix listed |
| avaya vsu | = 5x | No fix listed |
| avaya vsu | = 100_r2.0.1 | No fix listed |
| avaya vsu | = 500 | No fix listed |
| avaya vsu | = 2000_r2.0.1 | No fix listed |
| avaya vsu | = 5000_r2.0.1 | No fix listed |
| avaya vsu | = 7500_r2.0.1 | No fix listed |
| avaya vsu | = 10000_r2.0.1 | No fix listed |
| checkpoint firewall-1 | All versions | No fix listed |
| checkpoint firewall-1 | = 2.0 | No fix listed |
| checkpoint firewall-1 | = next_generation_fp0 | No fix listed |
| checkpoint firewall-1 | = next_generation_fp1 | No fix listed |
| checkpoint firewall-1 | = next_generation_fp2 | No fix listed |
| checkpoint provider-1 | = 4.1 | No fix listed |
| checkpoint provider-1 | = 4.1-sp1 | No fix listed |
| checkpoint provider-1 | = 4.1-sp2 | No fix listed |
| checkpoint provider-1 | = 4.1-sp3 | No fix listed |
| checkpoint provider-1 | = 4.1-sp4 | No fix listed |
| checkpoint vpn-1 | = next_generation_fp0 | No fix listed |
| checkpoint vpn-1 | = next_generation_fp1 | No fix listed |
| checkpoint vpn-1 | = next_generation_fp2 | No fix listed |
| checkpoint vpn-1 | = vsx_ng_with_application_intelligence | No fix listed |
| cisco access registrar | All versions | No fix listed |
| cisco application and content networking software | All versions | No fix listed |
| cisco css secure content accelerator | = 1.0 | No fix listed |
| cisco css secure content accelerator | = 2.0 | No fix listed |
| cisco css11000 content services switch | All versions | No fix listed |
| cisco okena stormwatch | = 3.2 | No fix listed |
| cisco pix firewall | = 6.2.2_.111 | No fix listed |
| cisco threat response | All versions | No fix listed |
| cisco webns | = 6.10 | No fix listed |
| cisco webns | = 6.10_b4 | No fix listed |
| cisco webns | = 7.1_0.1.02 | No fix listed |
| cisco webns | = 7.1_0.2.06 | No fix listed |
| cisco webns | = 7.2_0.0.03 | No fix listed |
| cisco webns | = 7.10 | No fix listed |
| cisco webns | = 7.10_.0.06s | No fix listed |
| Dell bsafe ssl-j | = 3.0 | No fix listed |
| Dell bsafe ssl-j | = 3.0.1 | No fix listed |
| Dell bsafe ssl-j | = 3.1 | No fix listed |
| forcepoint stonegate | = 1.5.17 | No fix listed |
| forcepoint stonegate | = 1.5.18 | No fix listed |
| forcepoint stonegate | = 1.6.2 | No fix listed |
| forcepoint stonegate | = 1.6.3 | No fix listed |
| forcepoint stonegate | = 1.7 | No fix listed |
| forcepoint stonegate | = 1.7.1 | No fix listed |
| forcepoint stonegate | = 1.7.2 | No fix listed |
| forcepoint stonegate | = 2.0.1 | No fix listed |
| forcepoint stonegate | = 2.0.4 | No fix listed |
| forcepoint stonegate | = 2.0.5 | No fix listed |
| forcepoint stonegate | = 2.0.6 | No fix listed |
| forcepoint stonegate | = 2.0.7 | No fix listed |
| forcepoint stonegate | = 2.0.8 | No fix listed |
| forcepoint stonegate | = 2.0.9 | No fix listed |
| forcepoint stonegate | = 2.1 | No fix listed |
| forcepoint stonegate | = 2.2 | No fix listed |
| forcepoint stonegate | = 2.2.1 | No fix listed |
| forcepoint stonegate | = 2.2.4 | No fix listed |
| HP Inc wbem | = a.01.05.08 | No fix listed |
| HP Inc wbem | = a.02.00.00 | No fix listed |
| HP Inc wbem | = a.02.00.01 | No fix listed |
| litespeedtech litespeed web server | = 1.0.1 | No fix listed |
| neoteris instant virtual extranet | = 3.0 | No fix listed |
| neoteris instant virtual extranet | = 3.1 | No fix listed |
| neoteris instant virtual extranet | = 3.2 | No fix listed |
| neoteris instant virtual extranet | = 3.3 | No fix listed |
| neoteris instant virtual extranet | = 3.3.1 | No fix listed |
| novell edirectory | = 8.0 | No fix listed |
| novell edirectory | = 8.5 | No fix listed |
| novell edirectory | = 8.5.12a | No fix listed |
| novell edirectory | = 8.5.27 | No fix listed |
| novell edirectory | = 8.6.2 | No fix listed |
| novell edirectory | = 8.7 | No fix listed |
| novell edirectory | = 8.7.1 | No fix listed |
| novell edirectory | = 8.7.1-sp1 | No fix listed |
| novell imanager | = 1.5 | No fix listed |
| novell imanager | = 2.0 | No fix listed |
| OpenSSL | = 0.9.6c | No fix listed |
| OpenSSL | = 0.9.6d | No fix listed |
| OpenSSL | = 0.9.6e | No fix listed |
| OpenSSL | = 0.9.6f | No fix listed |
| OpenSSL | = 0.9.6g | No fix listed |
| OpenSSL | = 0.9.6h | No fix listed |
| OpenSSL | = 0.9.6i | No fix listed |
| OpenSSL | = 0.9.6j | No fix listed |
| OpenSSL | = 0.9.6k | No fix listed |
| OpenSSL | = 0.9.7 | No fix listed |
| OpenSSL | = 0.9.7-beta1 | No fix listed |
| OpenSSL | = 0.9.7-beta2 | No fix listed |
| OpenSSL | = 0.9.7-beta3 | No fix listed |
| OpenSSL | = 0.9.7a | No fix listed |
| OpenSSL | = 0.9.7b | No fix listed |
| OpenSSL | = 0.9.7c | No fix listed |
| redhat openssl | = 0.9.6-15 | No fix listed |
| redhat openssl | = 0.9.6b-3 | No fix listed |
| redhat openssl | = 0.9.7a-2 | No fix listed |
| sgi propack | = 2.3 | No fix listed |
| sgi propack | = 2.4 | No fix listed |
| sgi propack | = 3.0 | No fix listed |
| stonesoft servercluster | = 2.5 | No fix listed |
| stonesoft servercluster | = 2.5.2 | No fix listed |
| stonesoft stonebeat fullcluster | = 1_2.0 | No fix listed |
| stonesoft stonebeat fullcluster | = 1_3.0 | No fix listed |
| stonesoft stonebeat fullcluster | = 2.0 | No fix listed |
| stonesoft stonebeat fullcluster | = 2.5 | No fix listed |
| stonesoft stonebeat fullcluster | = 3.0 | No fix listed |
| stonesoft stonebeat securitycluster | = 2.0 | No fix listed |
| stonesoft stonebeat securitycluster | = 2.5 | No fix listed |
| stonesoft stonebeat webcluster | = 2.0 | No fix listed |
| stonesoft stonebeat webcluster | = 2.5 | No fix listed |
| tarantella enterprise | = 3.20 | No fix listed |
| tarantella enterprise | = 3.30 | No fix listed |
| tarantella enterprise | = 3.40 | No fix listed |
| VMware gsx server | = 2.0 | No fix listed |
| VMware gsx server | = 2.0.1_build_2129 | No fix listed |
| VMware gsx server | = 2.5.1 | No fix listed |
| VMware gsx server | = 2.5.1_build_5336 | No fix listed |
| VMware gsx server | = 3.0_build_7592 | No fix listed |
| avaya s8300 | = r2.0.0 | No fix listed |
| avaya s8300 | = r2.0.1 | No fix listed |
| avaya s8500 | = r2.0.0 | No fix listed |
| avaya s8500 | = r2.0.1 | No fix listed |
| avaya s8700 | = r2.0.0 | No fix listed |
| avaya s8700 | = r2.0.1 | No fix listed |
| bluecoat proxysg | All versions | No fix listed |
| cisco call manager | All versions | No fix listed |
| cisco content services switch 11500 | All versions | No fix listed |
| cisco gss 4480 global site selector | All versions | No fix listed |
| cisco gss 4490 global site selector | All versions | No fix listed |
| cisco mds 9000 | All versions | No fix listed |
| cisco secure content accelerator | = 10000 | No fix listed |
| securecomputing sidewinder | = 5.2 | No fix listed |
| securecomputing sidewinder | = 5.2.0.01 | No fix listed |
| securecomputing sidewinder | = 5.2.0.02 | No fix listed |
References
- CLA-2004:834 broken-link vendor-advisory
- docs.info.apple.com broken-link
- APPLE-SA-2005-08-17 mailing-list vendor-advisory
- APPLE-SA-2005-08-15 mailing-list vendor-advisory
- lists.apple.com broken-link
- 20040317 New OpenSSL releases fix denial of service attacks [17 March 2004] mailing-list third-party-advisory
- SSRT4717 mailing-list third-party-advisory vendor-advisory
- 11139 broken-link third-party-advisory
- GLSA-200403-03 third-party-advisory vendor-advisory
- 57524 broken-link vendor-advisory
- O-101 broken-link government-resource third-party-advisory
- 20040317 Cisco OpenSSL Implementation Vulnerability broken-link vendor-advisory
- VU#484726 third-party-advisory us-government-resource
- MDKSA-2004:023 third-party-advisory vendor-advisory
- SuSE-SA:2004:007 broken-link vendor-advisory
- www.openssl.org broken-link
- RHSA-2004:120 broken-link vendor-advisory
- RHSA-2004:121 broken-link vendor-advisory
- 9899 broken-link third-party-advisory vdb-entry vendor-advisory
- SSA:2004-077 broken-link vendor-advisory
- 2004-0012 broken-link vendor-advisory
- www.uniras.gov.uk broken-link
- TA04-078A broken-link third-party-advisory us-government-resource
- openssl-kerberos-ciphersuites-dos(15508) third-party-advisory vdb-entry
- oval:org.mitre.oval:def:1049 broken-link signature vdb-entry
- oval:org.mitre.oval:def:928 broken-link signature vdb-entry
- oval:org.mitre.oval:def:9580 broken-link signature vdb-entry
- Debian Security Tracker CVE-2004-0112 vendor-advisory