1. CVE-Search
  2. CVE-2009-0847
ID CVE-2009-0847
Summary The asn1buf_imbed function in the ASN.1 decoder in MIT Kerberos 5 (aka krb5) 1.6.3, when PK-INIT is used, allows remote attackers to cause a denial of service (application crash) via a crafted length value that triggers an erroneous malloc call, related to incorrect calculations with pointer arithmetic.
References
Vulnerable Configurations
  • cpe:2.3:a:mit:kerberos:5-1.6.3:*:*:*:*:*:*:*
    cpe:2.3:a:mit:kerberos:5-1.6.3:*:*:*:*:*:*:*
CVSS
Base: 4.3 (as of 10-10-2018 - 19:32)
Impact:
Exploitability:
CWE CWE-189
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
cvss-vector via4 AV:N/AC:M/Au:N/C:N/I:N/A:P
oval via4
accepted 2015-04-20T04:02:31.586-04:00
class vulnerability
contributors
  • name Pai Peng
    organization Hewlett-Packard
  • name Sushant Kumar Singh
    organization Hewlett-Packard
  • name Sushant Kumar Singh
    organization Hewlett-Packard
  • name Prashant Kumar
    organization Hewlett-Packard
  • name Mike Cokus
    organization The MITRE Corporation
description The asn1buf_imbed function in the ASN.1 decoder in MIT Kerberos 5 (aka krb5) 1.6.3, when PK-INIT is used, allows remote attackers to cause a denial of service (application crash) via a crafted length value that triggers an erroneous malloc call, related to incorrect calculations with pointer arithmetic.
family unix
id oval:org.mitre.oval:def:6387
status accepted
submitted 2009-08-11T16:16:36.000-04:00
title HP-UX Running Kerberos, Remote Denial of Service (DoS), Execution of Arbitrary Code
version 46
refmap via4
apple APPLE-SA-2009-05-12
bid 34408
bugtraq
  • 20090407 MITKRB5-SA-2009-001: multiple vulnerabilities in SPNEGO, ASN.1 decoder [CVE-2009-0844 CVE-2009-0845 CVE-2009-0847]
  • 20090407 rPSA-2009-0058-1 krb5 krb5-server krb5-services krb5-test krb5-workstation
cert TA09-133A
cert-vn VU#662091
confirm
fedora
  • FEDORA-2009-2834
  • FEDORA-2009-2852
gentoo GLSA-200904-09
hp
  • HPSBUX02421
  • SSRT090047
mandriva MDVSA-2009:098
misc
sectrack 1021993
secunia
  • 34594
  • 34617
  • 34622
  • 34628
  • 34637
  • 34640
  • 34734
  • 35074
sunalert 256728
ubuntu USN-755-1
vupen
  • ADV-2009-0960
  • ADV-2009-0976
  • ADV-2009-1057
  • ADV-2009-1106
  • ADV-2009-1297
  • ADV-2009-2084
  • ADV-2009-2248
statements via4
contributor Tomas Hoger
lastmodified 2009-04-09
organization Red Hat
statement Not vulnerable. This issue did not affect the versions of krb5 as shipped with Red Hat Enterprise Linux 2.1, 3, 4, or 5.
Last major update 10-10-2018 - 19:32
Published 09-04-2009 - 00:30
Last modified 10-10-2018 - 19:32
Back to Top