CVE-2009-0844 The get_input_token function in the SPNEGO implementation in MIT Kerberos 5 (aka krb5) 1.5 through 1.6.3 allows remote attackers to cause a denial of service (daemon crash) and possibly obtain sensiti...
MediumCVSS 5.8
EPSS 4.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The get_input_token function in the SPNEGO implementation in MIT Kerberos 5 (aka krb5) 1.5 through 1.6.3 allows remote attackers to cause a denial of service (daemon crash) and possibly obtain sensitive information via a crafted length value that triggers a buffer over-read.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mit kerberos | = 5-1.6.3 | No fix listed |
| mit kerberos 5 | All versions | No fix listed |
| mit kerberos 5 | = 1.5 | No fix listed |
| mit kerberos 5 | = 1.5.1 | No fix listed |
| mit kerberos 5 | = 1.5.2 | No fix listed |
| mit kerberos 5 | = 1.5.3 | No fix listed |
| mit kerberos 5 | = 1.6 | No fix listed |
| mit kerberos 5 | = 1.6.1 | No fix listed |
| mit kerberos 5 | = 1.6.2 | No fix listed |
| debian/krb5(Debian:12) | < 1.6.dfsg.4~beta1-13 | 1.6.dfsg.4~beta1-13 |
| debian/krb5(Debian:13) | < 1.6.dfsg.4~beta1-13 | 1.6.dfsg.4~beta1-13 |
| debian/krb5(Debian:14) | < 1.6.dfsg.4~beta1-13 | 1.6.dfsg.4~beta1-13 |
References
- APPLE-SA-2009-05-12 vendor-advisory
- 34594 third-party-advisory
- 34617 third-party-advisory
- 34622 third-party-advisory
- 34628 third-party-advisory
- 34630 third-party-advisory
- 34637 third-party-advisory
- 34640 third-party-advisory
- 34734 third-party-advisory
- 35074 third-party-advisory
- GLSA-200904-09 vendor-advisory
- 256728 vendor-advisory
- support.apple.com
- support.avaya.com
- support.novell.com
- support.novell.com
- web.mit.edu
- wiki.rpath.com
- wiki.rpath.com
- www-01.ibm.com
- VU#662091 third-party-advisory us-government-resource
- MDVSA-2009:098 vendor-advisory
- RHSA-2009:0408 vendor-advisory
- 20090407 MITKRB5-SA-2009-001: multiple vulnerabilities in SPNEGO, ASN.1 decoder [CVE-2009-0844 CVE-2009-0845 CVE-2009-0847] mailing-list
- 20090407 rPSA-2009-0058-1 krb5 krb5-server krb5-services krb5-test krb5-workstation mailing-list
- 34408 vdb-entry
- 1021867 vdb-entry
- USN-755-1 vendor-advisory
- TA09-133A third-party-advisory us-government-resource
- ADV-2009-0960 vdb-entry
- ADV-2009-0976 vdb-entry
- ADV-2009-1057 vdb-entry
- ADV-2009-1106 vdb-entry
- ADV-2009-1297 vdb-entry
- ADV-2009-2248 vdb-entry
- oval:org.mitre.oval:def:6339 signature vdb-entry
- oval:org.mitre.oval:def:9474 signature vdb-entry
- FEDORA-2009-2834 vendor-advisory
- FEDORA-2009-2852 vendor-advisory
- Debian Security Tracker CVE-2009-0844 vendor-advisory