CVE-2009-0847

MIT Kerberos 5 1.6.3 - Denial of Service via ASN.1 Decoder Length Miscount

Title source: llm
STIX 2.1

Description

The asn1buf_imbed function in the ASN.1 decoder in MIT Kerberos 5 (aka krb5) 1.6.3, when PK-INIT is used, allows remote attackers to cause a denial of service (application crash) via a crafted length value that triggers an erroneous malloc call, related to incorrect calculations with pointer arithmetic.

References (38)

Core 38
Core References
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2009:098
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/502526/100/0/threaded
Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert-vn
http://www.kb.cert.org/vuls/id/662091
Vendor Advisory x_refsource_confirm
http://support.apple.com/kb/HT3549
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/usn-755-1
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2009/0960
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6387
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/34637
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2009/2084
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/34408
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/34640
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/35074
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1021993
Vendor Advisory vendor-advisory x_refsource_sunalert
http://sunsolve.sun.com/search/document.do?assetkey=1-26-256728-1
Third Party Advisory vendor-advisory x_refsource_gentoo
http://security.gentoo.org/glsa/glsa-200904-09.xml
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2009/0976
Mailing List vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
Various Sources x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21396120
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2009/1057
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/34617
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/34628
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/34734
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2009/2248
US Government Resource third-party-advisory x_refsource_cert
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
Third Party Advisory x_refsource_misc
http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0058
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2009/1297
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/34622
Third Party Advisory x_refsource_confirm
http://wiki.rpath.com/Advisories:rPSA-2009-0058
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/502546/100/0/threaded
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/34594
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2009/1106
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=124896429301168&w=2

Scores

EPSS 0.2029
EPSS Percentile 95.6%

Details

CWE
CWE-189
Status published
Products (1)
mit/kerberos 5-1.6.3
Published Apr 09, 2009
Tracked Since Feb 18, 2026