CVE-2009-0845
Published Mar 27, 2009
Last updated 5 years ago
Overview
- Description
- The spnego_gss_accept_sec_context function in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.5 through 1.6.3, when SPNEGO is used, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via invalid ContextFlags data in the reqFlags field in a negTokenInit token.
- Source
- cve@mitre.org
- NVD status
- Modified
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 2.0
- Type
- Primary
- Base score
- 5
- Impact score
- 2.9
- Exploitability score
- 10
- Vector string
- AV:N/AC:L/Au:N/C:N/I:N/A:P
Weaknesses
- nvd@nist.gov
- CWE-20
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mit:kerberos:5-1.6.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "032730AE-1E53-4CA2-96FD-AD60CD27F3CA"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4DD315AE-868B-4061-BF01-CDBF59B02499"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.5.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B639DD5F-71C7-4D9B-BA5C-51CAF64140B6"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.5.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2B904DCE-D59F-45C7-A814-DE42CF02792D"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.5.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9957FE9E-1E89-4C27-852C-44F866A1834E"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2C382DAA-68D2-4DD9-BE29-8EEB0BAF1A7A"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.6.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "73BB258E-51CF-4D12-836B-BCEA587A3F5F"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.6.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F81DE01C-BA3B-40B4-BD85-17692F0AF8A8"
}
],
"operator": "OR"
}
]
}
]