CVE-2010-0433
05.03.2010, 19:30
The kssl_keytab_is_available function in ssl/kssl.c in OpenSSL before 0.9.8n, when Kerberos is enabled but Kerberos configuration files cannot be opened, does not check a certain return value, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via SSL cipher negotiation, as demonstrated by a chroot installation of Dovecot or stunnel without Kerberos configuration files inside the chroot.Enginsight
| Vendor | Product | Version |
|---|---|---|
| openssl | openssl | 𝑥 ≤ 0.9.8m |
| openssl | openssl | 0.9.8 |
| openssl | openssl | 0.9.8a |
| openssl | openssl | 0.9.8b |
| openssl | openssl | 0.9.8c |
| openssl | openssl | 0.9.8d |
| openssl | openssl | 0.9.8e |
| openssl | openssl | 0.9.8f |
| openssl | openssl | 0.9.8g |
| openssl | openssl | 0.9.8h |
| openssl | openssl | 0.9.8i |
| openssl | openssl | 0.9.8j |
| openssl | openssl | 0.9.8k |
| openssl | openssl | 0.9.8l |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References