NSS parsing errors with zero length items — Mozilla

Security researcher Kaspar Brand found a flaw in how the Network Security Services NSS ASN.1 decoder handles zero length items. Effects of this issue depend on the field. One known symptom is an unexploitable crash in handling OCSP responses. NSS also mishandles zero-length basic constraints,...

CentOS Update for krb5-devel CESA-2009:0409 centos4 i386

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

CentOS Update for krb5 CESA-2009:0410-01 centos2 i386

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Mandriva Security Advisory MDVSA-2009:098-1 (krb5)

The remote host is missing an update to krb5 announced via advisory MDVSA-2009:098-1. OpenVAS Vulnerability Test $Id: mdksa20090981.nasl 6573 2017-07-06 13:10:50Z cfischer $ Description: Auto-generated from advisory MDVSA-2009:098-1 krb5 Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft...

Mandrake Security Advisory MDVSA-2009:098 (krb5)

The remote host is missing an update to krb5 announced via advisory MDVSA-2009:098. OpenVAS Vulnerability Test $Id: mdksa2009098.nasl 6573 2017-07-06 13:10:50Z cfischer $ Description: Auto-generated from advisory MDVSA-2009:098 krb5 Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft Inc...

FreeBSD : krb5 -- ASN.1 decoder denial-of-service vulnerability (bd60922b-fb8d-11d8-a13e-000a95bc6fae)

An advisory published by the MIT Kerberos team says : The ASN.1 decoder library in the MIT Kerberos 5 distribution is vulnerable to a denial-of-service attack causing an infinite loop in the decoder. The KDC is vulnerable to this attack. An unauthenticated remote attacker can cause a KDC or...

SuSE Security Advisory SUSE-SA:2009:019 (krb5)

The remote host is missing updates announced in advisory SUSE-SA:2009:019. OpenVAS Vulnerability Test $Id: susesa2009019.nasl 6668 2017-07-11 13:34:29Z cfischer $ Description: Auto-generated from advisory SUSE-SA:2009:019 krb5 Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft Inc...

Design/Logic Flaw

The asn1bufimbed function in the ASN.1 decoder in MIT Kerberos 5 aka krb5 1.6.3, when PK-INIT is used, allows remote attackers to cause a denial of service application crash via a crafted length value that triggers an erroneous malloc call, related to incorrect calculations with pointer arithmeti...

CVE-2009-0847

The asn1bufimbed function in the ASN.1 decoder in MIT Kerberos 5 aka krb5 1.6.3, when PK-INIT is used, allows remote attackers to cause a denial of service application crash via a crafted length value that triggers an erroneous malloc call, related to incorrect calculations with pointer arithmeti...

CVE-2009-0847

The asn1bufimbed function in the ASN.1 decoder in MIT Kerberos 5 aka krb5 1.6.3, when PK-INIT is used, allows remote attackers to cause a denial of service application crash via a crafted length value that triggers an erroneous malloc call, related to incorrect calculations with pointer arithmeti...

DSA-1766-1 krb5 - several vulnerabilities

Bulletin has no description...

CVE-2009-0847

CVE-2009-0847 affects MIT Kerberos 5 (krb5) SPNEGO/GSS-API and the ASN.1 decoder. The OVMSA-2009-0003 advisory documents that 1.5–1.6.3 krb5 releases are vulnerable to crafted DER/length values, enabling remote attackers to crash daemons (and potentially execute code) due to length validation and...

RHEL 5 : krb5 (RHSA-2009:0408)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2009:0408 advisory. - krb5: buffer over-read in SPNEGO GSS-API mechanism MITKRB5-SA-2009-001 CVE-2009-0844 - krb5: NULL pointer dereference in GSSAPI SPNEGO...

MITKRB5-SA-2009-001: multiple vulnerabilities in SPNEGO, ASN.1 decoder [CVE-2009-0844 CVE-2009-0845 CVE-2009-0847]

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 MITKRB5-SA-2009-001 MIT krb5 Security Advisory 2009-001 Original release: 2009-04-07 Last update: 2009-04-07 Topic: multiple vulnerabilities in SPNEGO, ASN.1 decoder CVE-2009-0844 SPNEGO implementation can read beyond buffer end CVSSv2 Vector:...

RHEL 2.1 / 3 : krb5 (RHSA-2009:0410)

Updated krb5 packages that fix a security issue are now available for Red Hat Enterprise Linux 2.1 and 3. This update has been rated as having critical security impact by the Red Hat Security Response Team. Kerberos is a network authentication system which allows clients and servers to authentica...

MITKRB5-SA-2009-002: ASN.1 decoder frees uninitialized pointer [CVE-2009-0846]

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 MITKRB5-SA-2009-002 MIT krb5 Security Advisory 2009-002 Original release: 2009-04-07 Last update: 2009-04-07 Topic: ASN.1 decoder frees uninitialized pointer CVE-2009-0846 ASN.1 GeneralizedTime decoder can free uninitialized pointer CVSSv2 Vector:...

krb5 security update

1.3.4-60.el47.2 - whoops, actually add the patches 1.3.4-60.el47.1 - add fix for attempt to free uninitialized pointer in the ASN.1 decoder 491835, CVE-2009-0846 - add fix for bug in length validation in the ASN.1 decoder CVE-2009-0847...

krb5 security update

1.2.7-70 - override $SHLIBEXPFLAGS at build-time to ensure that shared libraries don't include an RPATH internal tools 1.2.7-69 - add backported fix for attempt to free uninitialized pointer in the ASN.1 decoder 491834, CVE-2009-0846 - add backported fix for bug in length validation in the ASN.1...

OpenLDAP denial-of-service flaw in ASN.1 decoder

liblber/io.c in OpenLDAP 2.2.4 to 2.4.10 allows remote attackers to cause a denial of service program termination via crafted ASN.1 BER datagrams that trigger an assertion error...

Debian Security Advisory DSA 1171-1 (ethereal)

The remote host is missing an update to ethereal announced via advisory DSA 1171-1. Several remote vulnerabilities have been discovered in the Ethereal network scanner, which may lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following...