CVE-2010-0433
05.03.2010, 19:30
The kssl_keytab_is_available function in ssl/kssl.c in OpenSSL before 0.9.8n, when Kerberos is enabled but Kerberos configuration files cannot be opened, does not check a certain return value, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via SSL cipher negotiation, as demonstrated by a chroot installation of Dovecot or stunnel without Kerberos configuration files inside the chroot.Enginsight
| Vendor | Product | Version |
|---|---|---|
| openssl | openssl | 𝑥 ≤ 0.9.8m |
| openssl | openssl | 0.9.8 |
| openssl | openssl | 0.9.8a:a |
| openssl | openssl | 0.9.8b:b |
| openssl | openssl | 0.9.8c:c |
| openssl | openssl | 0.9.8d:d |
| openssl | openssl | 0.9.8e:e |
| openssl | openssl | 0.9.8f:f |
| openssl | openssl | 0.9.8g:g |
| openssl | openssl | 0.9.8h:h |
| openssl | openssl | 0.9.8i:i |
| openssl | openssl | 0.9.8j:j |
| openssl | openssl | 0.9.8k:k |
| openssl | openssl | 0.9.8l:l |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Common Weakness Enumeration
References