CVE-2010-0433

The kssl_keytab_is_available function in ssl/kssl.c in OpenSSL before
0.9.8n, when Kerberos is enabled but Kerberos configuration files cannot be
opened, does not check a certain return value, which allows remote
attackers to cause a denial of service (NULL pointer dereference and daemon
crash) via SSL cipher negotiation, as demonstrated by a chroot installation
of Dovecot or stunnel without Kerberos configuration files inside the
chroot.

Bugs

• <https://bugzilla.redhat.com/show_bug.cgi?id=567711&gt;

Notes