CVE-2023-25567

CVE-2023-25567 affects the GSS-NTLMSSP mechglue in the GSSAPI library, producing an out-of-bounds read when decoding NTLM target information. The CVE is triggered via gss_accept_sec_context and could cause a denial of service if memory is unmapped. Publicly documented impact and remediation in th...

CVE-2023-25567 GSS-NTLMSSP vulnerable to out-of-bounds read when decoding target information

GSS-NTLMSSP, a mechglue plugin for the GSSAPI library that implements NTLM authentication, has an out-of-bounds read when decoding target information prior to version 1.2.0. The length of the avpair is not checked properly for two of the elements which can trigger an out-of-bound read. The...

CVE-2023-25567

GSS-NTLMSSP, a mechglue plugin for the GSSAPI library that implements NTLM authentication, has an out-of-bounds read when decoding target information prior to version 1.2.0. The length of the avpair is not checked properly for two of the elements which can trigger an out-of-bound read. The...