Lucene search

[email protected]NVD:CVE-2009-0846

HistoryApr 09, 2009 - 12:30 a.m.

CVE-2009-0846

2009-04-0900:30:00

CWE-824

[email protected]

web.nvd.nist.gov

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

AI Score

Confidence

High

EPSS

0.625

Percentile

97.9%

JSON

The asn1_decode_generaltime function in lib/krb5/asn.1/asn1_decode.c in the ASN.1 GeneralizedTime decoder in MIT Kerberos 5 (aka krb5) before 1.6.4 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via vectors involving an invalid DER encoding that triggers a free of an uninitialized pointer.

Affected configurations

Nvd

Node

mitkerberos_5Range<1.6.4

Node

fedoraprojectfedoraMatch9

fedoraprojectfedoraMatch10

Node

canonicalubuntu_linuxMatch6.06

canonicalubuntu_linuxMatch7.10

canonicalubuntu_linuxMatch8.04

canonicalubuntu_linuxMatch8.10

Node

applemac_os_xRange<10.5.7

Node

redhatenterprise_linuxMatch4.0

redhatenterprise_linux_desktopMatch3.0

redhatenterprise_linux_desktopMatch4.0

redhatenterprise_linux_eusMatch4.7

redhatenterprise_linux_serverMatch2.0

redhatenterprise_linux_serverMatch3.0

redhatenterprise_linux_serverMatch4.0

redhatenterprise_linux_workstationMatch2.0

redhatenterprise_linux_workstationMatch3.0

redhatenterprise_linux_workstationMatch4.0

VendorProductVersionCPE
mitkerberos_5*cpe:2.3:a:mit:kerberos_5:*:*:*:*:*:*:*:*
fedoraprojectfedora9cpe:2.3:o:fedoraproject:fedora:9:*:*:*:*:*:*:*
fedoraprojectfedora10cpe:2.3:o:fedoraproject:fedora:10:*:*:*:*:*:*:*
canonicalubuntu_linux6.06cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*
canonicalubuntu_linux7.10cpe:2.3:o:canonical:ubuntu_linux:7.10:*:*:*:*:*:*:*
canonicalubuntu_linux8.04cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:*:*:*:*
canonicalubuntu_linux8.10cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:*
applemac_os_x*cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
redhatenterprise_linux4.0cpe:2.3:o:redhat:enterprise_linux:4.0:*:*:*:*:*:*:*
redhatenterprise_linux_desktop3.0cpe:2.3:o:redhat:enterprise_linux_desktop:3.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mit	kerberos_5	*	cpe:2.3:a:mit:kerberos_5::::::::
fedoraproject	fedora	9	cpe:2.3:o:fedoraproject:fedora:9:::::::*
fedoraproject	fedora	10	cpe:2.3:o:fedoraproject:fedora:10:::::::*
canonical	ubuntu_linux	6.06	cpe:2.3:o:canonical:ubuntu_linux:6.06:::::::*
canonical	ubuntu_linux	7.10	cpe:2.3:o:canonical:ubuntu_linux:7.10:::::::*
canonical	ubuntu_linux	8.04	cpe:2.3:o:canonical:ubuntu_linux:8.04:::::::*
canonical	ubuntu_linux	8.10	cpe:2.3:o:canonical:ubuntu_linux:8.10:::::::*
apple	mac_os_x	*	cpe:2.3:o:apple:mac_os_x::::::::
redhat	enterprise_linux	4.0	cpe:2.3:o:redhat:enterprise_linux:4.0:::::::*
redhat	enterprise_linux_desktop	3.0	cpe:2.3:o:redhat:enterprise_linux_desktop:3.0:::::::*

Rows per page:

1-10 of 181

References

lists.apple.com/archives/security-announce/2009/May/msg00002.html

lists.vmware.com/pipermail/security-announce/2009/000059.html

marc.info/?l=bugtraq&m=124896429301168&w=2

marc.info/?l=bugtraq&m=130497213107107&w=2

rhn.redhat.com/errata/RHSA-2009-0409.html

rhn.redhat.com/errata/RHSA-2009-0410.html

secunia.com/advisories/34594

secunia.com/advisories/34598

secunia.com/advisories/34617

secunia.com/advisories/34622

secunia.com/advisories/34628

secunia.com/advisories/34630

secunia.com/advisories/34637

secunia.com/advisories/34640

secunia.com/advisories/34734

secunia.com/advisories/35074

secunia.com/advisories/35667

security.gentoo.org/glsa/glsa-200904-09.xml

sunsolve.sun.com/search/document.do?assetkey=1-26-256728-1

support.apple.com/kb/HT3549

support.avaya.com/elmodocs2/security/ASA-2009-142.htm

support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5047180.html

support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5047181.html

web.mit.edu/kerberos/advisories/MITKRB5-SA-2009-002.txt

wiki.rpath.com/Advisories:rPSA-2009-0058

wiki.rpath.com/wiki/Advisories:rPSA-2009-0058

www-01.ibm.com/support/docview.wss?uid=swg21396120

www.kb.cert.org/vuls/id/662091

www.mandriva.com/security/advisories?name=MDVSA-2009:098

www.redhat.com/support/errata/RHSA-2009-0408.html

www.securityfocus.com/archive/1/502527/100/0/threaded

www.securityfocus.com/archive/1/502546/100/0/threaded

www.securityfocus.com/archive/1/504683/100/0/threaded

www.securityfocus.com/bid/34409

www.securitytracker.com/id?1021994

www.ubuntu.com/usn/usn-755-1

www.us-cert.gov/cas/techalerts/TA09-133A.html

www.vmware.com/security/advisories/VMSA-2009-0008.html

www.vupen.com/english/advisories/2009/0960

www.vupen.com/english/advisories/2009/0976

www.vupen.com/english/advisories/2009/1057

www.vupen.com/english/advisories/2009/1106

www.vupen.com/english/advisories/2009/1297

www.vupen.com/english/advisories/2009/2084

www.vupen.com/english/advisories/2009/2248

oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10694

oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5483

oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6301

www.redhat.com/archives/fedora-package-announce/2009-April/msg00205.html

www.redhat.com/archives/fedora-package-announce/2009-April/msg00206.html

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

AI Score

Confidence

High

EPSS

0.625

Percentile

97.9%

JSON

Related for NVD:CVE-2009-0846

centos4 ubuntucve1 redhat3 openvas67 debiancve1 cvelist1 cve1 checkpoint_advisories2 prion1 securityvulns3 nessus31 veracode1 oraclelinux3 vmware4 suse1 debian1 osv2 fedora2 gentoo1 ubuntu1