MIT Kerberos SPNEGO和ASN.1多个拒绝服务漏洞

BUGTRAQ ID: 34408 CVECAN ID: CVE-2009-0844,CVE-2009-0847 Kerberos是一款广泛使用的使用强壮的加密来验证客户端和服务器端的网络协议。MIT Kerberos 5是一种常用的开源Kerberos实现。 krb5在实现SPNEGO GSS-API机制时getinputtoken函数可能会读过网络输入缓冲区的末尾，如果读取了无效地址空间可能会导致任何使用Kerberos GSS-API库来认证用户的网络服务崩溃。...

[SECURITY] [DSA 1766-1] New krb5 packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA-1766-1 [email protected] http://www.debian.org/security/ Nico Golde April 9th, 2009 http://www.debian.org/security/faq -...

CVE-2009-0847

The asn1bufimbed function in the ASN.1 decoder in MIT Kerberos 5 aka krb5 1.6.3, when PK-INIT is used, allows remote attackers to cause a denial of service application crash via a crafted length value that triggers an erroneous malloc call, related to incorrect calculations with pointer arithmeti...

CVE-2009-0847

CVE-2009-0847 affects MIT Kerberos 5 (krb5) SPNEGO/GSS-API and the ASN.1 decoder. The OVMSA-2009-0003 advisory documents that 1.5–1.6.3 krb5 releases are vulnerable to crafted DER/length values, enabling remote attackers to crash daemons (and potentially execute code) due to length validation and...

openSUSE 10 Security Update : krb5 (krb5-6139)

Clients sending negotiation requests with invalid flags could crash the kerberos server CVE-2009-0845. GSS-API clients could crash when reading from an invalid address space CVE-2009-0844. Invalid length checks could crash applications using the kerberos ASN.1 parser CVE-2009-0847. Under certain...

CVE-2009-0847

The asn1bufimbed function in the ASN.1 decoder in MIT Kerberos 5 aka krb5 1.6.3, when PK-INIT is used, allows remote attackers to cause a denial of service application crash via a crafted length value that triggers an erroneous malloc call, related to incorrect calculations with pointer arithmeti...

Gentoo Security Advisory GLSA 200605-16 (cherrypy)

The remote host is missing updates announced in advisory GLSA 200605-16. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

CVE-2008-0847

SQL injection vulnerability in print.php in the myTopics module for XOOPS allows remote attackers to execute arbitrary SQL commands via the articleid parameter...

CVE-2007-0847

Open Tibia Server CMS (OTSCMS) up to version 2.1.5 is affected by a SQL injection in mod/PM/reply.php, exploitable via the id parameter to priv.php. This allows remote attackers to execute arbitrary SQL commands. The affected component is the web-based CMS for OTSCMS; root cause is improper handl...

CVE-2006-0847

CherryPy’s staticfilter component contains a directory traversal vulnerability (CVE-2006-0847) that allows remote attackers to read arbitrary files via ".." sequences in unspecified vectors. Affected: CherryPy prior to 2.1.1. Impact: could expose arbitrary server files. Root cause: inadequate inp...

CherryPy staticFilter Traversal Arbitrary File Access

The remote host is running CherryPy, a web server powered by Python. The installed version of CherryPy fails to filter directory traversal sequences from requests that pass through its 'staticFilter' module. An attacker can exploit this issue to read arbitrary files on the remote host subject to...

CVE-2005-0847

CVE-2005-0847 affects Code Ocean FTP server 1.0; a flaw allows remote attackers to cause a denial of service via a large number of connections. The CVSS base score is 5.0 (Medium) with network attack vector, low complexity, no authentication, and partial availability impact. Exploit details are n...

CVE-2004-0847

The Microsoft .NET forms authentication capability for ASP.NET allows remote attackers to bypass authentication for .aspx files in restricted directories via a request containing a 1 "" backslash or 2 "%5C" encoded backslash, aka "Path Validation Vulnerability."...

CVE-2003-0847

SuSEconfig.susewm in the susewm package on SuSE Linux 8.2Pro allows local users to overwrite arbitrary files via a symlink attack on the susewm.$$ temporary file...

CVE-2003-0847

CVE-2003-0847 : The SuSEconfig.susewm component in the susewm package on SuSE Linux 8.2Pro is vulnerable to a local, symlink-based attack on the susewm.$$ temporary file, enabling local users to overwrite arbitrary files. The vulnerability is described as a local-priority issue with partial confi...

CVE-2003-0847

SuSEconfig.susewm in the susewm package on SuSE Linux 8.2Pro allows local users to overwrite arbitrary files via a symlink attack on the susewm.$$ temporary file...

CVE-2002-0847

CVE-2002-0847 affects tinyproxy (versions up to 1.5.0, 1.4.3 and earlier) where improper handling of certain invalid proxy requests leads to a double-free of memory, enabling potential remote code execution. Multiple connected sources corroborate the doubly freed memory vulnerability in tinyproxy...

CVE-2002-0847

tinyproxy HTTP proxy 1.5.0, 1.4.3, and earlier allows remote attackers to execute arbitrary code via memory that is freed twice double-free...

CVE-2002-0847

tinyproxy HTTP proxy 1.5.0, 1.4.3, and earlier allows remote attackers to execute arbitrary code via memory that is freed twice double-free...

CVE-2002-0847

tinyproxy HTTP proxy 1.5.0, 1.4.3, and earlier allows remote attackers to execute arbitrary code via memory that is freed twice double-free...