ByteOS Network

▼CVE Numbering Authority (CNA)

The kssl_keytab_is_available function in ssl/kssl.c in OpenSSL before 0.9.8n, when Kerberos is enabled but Kerberos configuration files cannot be opened, does not check a certain return value, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via SSL cipher negotiation, as demonstrated by a chroot installation of Dovecot or stunnel without Kerberos configuration files inside the chroot.

Affected Products

Vendor

n/a

Product

n/a

Versions

Affected

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
http://www.vupen.com/english/advisories/2010/0916	vdb-entry x_refsource_VUPEN
http://secunia.com/advisories/42724	third-party-advisory x_refsource_SECUNIA
http://secunia.com/advisories/39461	third-party-advisory x_refsource_SECUNIA
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9856	vdb-entry signature x_refsource_OVAL
https://bugzilla.redhat.com/show_bug.cgi?id=569774	x_refsource_CONFIRM
http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039561.html	vendor-advisory x_refsource_FEDORA
http://marc.info/?l=bugtraq&m=127557640302499&w=2	vendor-advisory x_refsource_HP
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12260	vdb-entry signature x_refsource_OVAL
http://www.openwall.com/lists/oss-security/2010/03/03/5	mailing-list x_refsource_MLIST
http://www.mail-archive.com/dovecot%40dovecot.org/msg26224.html	mailing-list x_refsource_MLIST
https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000101.html	mailing-list x_refsource_MLIST
https://bugzilla.redhat.com/show_bug.cgi?id=567711	x_refsource_CONFIRM
http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html	x_refsource_CONFIRM
http://www.vupen.com/english/advisories/2010/0839	vdb-entry x_refsource_VUPEN
http://cvs.openssl.org/chngview?cn=19374	x_refsource_CONFIRM
http://marc.info/?l=bugtraq&m=127557640302499&w=2	vendor-advisory x_refsource_HP
http://www.mandriva.com/security/advisories?name=MDVSA-2010:076	vendor-advisory x_refsource_MANDRIVA
http://marc.info/?l=bugtraq&m=127128920008563&w=2	vendor-advisory x_refsource_HP
https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000102.html	mailing-list x_refsource_MLIST
http://secunia.com/advisories/39932	third-party-advisory x_refsource_SECUNIA
http://www.openssl.org/news/changelog.html	x_refsource_CONFIRM
http://www.vupen.com/english/advisories/2010/0933	vdb-entry x_refsource_VUPEN
http://www.vmware.com/security/advisories/VMSA-2011-0003.html	x_refsource_CONFIRM
http://marc.info/?l=bugtraq&m=127128920008563&w=2	vendor-advisory x_refsource_HP
https://kb.bluecoat.com/index?page=content&id=SA50	x_refsource_CONFIRM
http://www.securityfocus.com/archive/1/516397/100/0/threaded	mailing-list x_refsource_BUGTRAQ
http://secunia.com/advisories/43311	third-party-advisory x_refsource_SECUNIA
http://www.vupen.com/english/advisories/2010/1216	vdb-entry x_refsource_VUPEN
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6718	vdb-entry signature x_refsource_OVAL
http://secunia.com/advisories/42733	third-party-advisory x_refsource_SECUNIA
http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038587.html	vendor-advisory x_refsource_FEDORA
http://aix.software.ibm.com/aix/efixes/security/openssl_advisory.asc	x_refsource_CONFIRM
http://groups.google.com/group/mailing.openssl.users/browse_thread/thread/c3e1ab0034ca4b4c/66aa896c3a78b2f7	x_refsource_MISC

Hyperlink: http://www.vupen.com/english/advisories/2010/0916

Resource:

vdb-entry

x_refsource_VUPEN

Hyperlink: http://secunia.com/advisories/42724

Resource:

third-party-advisory

x_refsource_SECUNIA

Hyperlink: http://secunia.com/advisories/39461

Resource:

third-party-advisory

x_refsource_SECUNIA

Hyperlink: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9856

Resource:

vdb-entry

signature

x_refsource_OVAL

Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=569774

Resource:

x_refsource_CONFIRM

Hyperlink: http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039561.html

Resource:

vendor-advisory

x_refsource_FEDORA

Hyperlink: http://marc.info/?l=bugtraq&m=127557640302499&w=2

Resource:

vendor-advisory

x_refsource_HP

Hyperlink: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12260

Resource:

vdb-entry

signature

x_refsource_OVAL

Hyperlink: http://www.openwall.com/lists/oss-security/2010/03/03/5

Resource:

mailing-list

x_refsource_MLIST

Hyperlink: http://www.mail-archive.com/dovecot%40dovecot.org/msg26224.html

Resource:

mailing-list

x_refsource_MLIST

Hyperlink: https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000101.html

Resource:

mailing-list

x_refsource_MLIST

Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=567711

Resource:

x_refsource_CONFIRM

Hyperlink: http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html

Resource:

x_refsource_CONFIRM

Hyperlink: http://www.vupen.com/english/advisories/2010/0839

Resource:

vdb-entry

x_refsource_VUPEN

Hyperlink: http://cvs.openssl.org/chngview?cn=19374

Resource:

x_refsource_CONFIRM

Hyperlink: http://marc.info/?l=bugtraq&m=127557640302499&w=2

Resource:

vendor-advisory

x_refsource_HP

Hyperlink: http://www.mandriva.com/security/advisories?name=MDVSA-2010:076

Resource:

vendor-advisory

x_refsource_MANDRIVA

Hyperlink: http://marc.info/?l=bugtraq&m=127128920008563&w=2

Resource:

vendor-advisory

x_refsource_HP

Hyperlink: https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000102.html

Resource:

mailing-list

x_refsource_MLIST

Hyperlink: http://secunia.com/advisories/39932

Resource:

third-party-advisory

x_refsource_SECUNIA

Hyperlink: http://www.openssl.org/news/changelog.html

Resource:

x_refsource_CONFIRM

Hyperlink: http://www.vupen.com/english/advisories/2010/0933

Resource:

vdb-entry

x_refsource_VUPEN

Hyperlink: http://www.vmware.com/security/advisories/VMSA-2011-0003.html

Resource:

x_refsource_CONFIRM

Hyperlink: http://marc.info/?l=bugtraq&m=127128920008563&w=2

Resource:

vendor-advisory

x_refsource_HP

Hyperlink: https://kb.bluecoat.com/index?page=content&id=SA50

Resource:

x_refsource_CONFIRM

Hyperlink: http://www.securityfocus.com/archive/1/516397/100/0/threaded

Resource:

mailing-list

x_refsource_BUGTRAQ

Hyperlink: http://secunia.com/advisories/43311

Resource:

third-party-advisory

x_refsource_SECUNIA

Hyperlink: http://www.vupen.com/english/advisories/2010/1216

Resource:

vdb-entry

x_refsource_VUPEN

Hyperlink: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6718

Resource:

vdb-entry

signature

x_refsource_OVAL

Hyperlink: http://secunia.com/advisories/42733

Resource:

third-party-advisory

x_refsource_SECUNIA

Hyperlink: http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038587.html

Resource:

vendor-advisory

x_refsource_FEDORA

Hyperlink: http://aix.software.ibm.com/aix/efixes/security/openssl_advisory.asc

Resource:

x_refsource_CONFIRM

Hyperlink: http://groups.google.com/group/mailing.openssl.users/browse_thread/thread/c3e1ab0034ca4b4c/66aa896c3a78b2f7

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
http://www.vupen.com/english/advisories/2010/0916	vdb-entry x_refsource_VUPEN x_transferred
http://secunia.com/advisories/42724	third-party-advisory x_refsource_SECUNIA x_transferred
http://secunia.com/advisories/39461	third-party-advisory x_refsource_SECUNIA x_transferred
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9856	vdb-entry signature x_refsource_OVAL x_transferred
https://bugzilla.redhat.com/show_bug.cgi?id=569774	x_refsource_CONFIRM x_transferred
http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039561.html	vendor-advisory x_refsource_FEDORA x_transferred
http://marc.info/?l=bugtraq&m=127557640302499&w=2	vendor-advisory x_refsource_HP x_transferred
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12260	vdb-entry signature x_refsource_OVAL x_transferred
http://www.openwall.com/lists/oss-security/2010/03/03/5	mailing-list x_refsource_MLIST x_transferred
http://www.mail-archive.com/dovecot%40dovecot.org/msg26224.html	mailing-list x_refsource_MLIST x_transferred
https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000101.html	mailing-list x_refsource_MLIST x_transferred
https://bugzilla.redhat.com/show_bug.cgi?id=567711	x_refsource_CONFIRM x_transferred
http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html	x_refsource_CONFIRM x_transferred
http://www.vupen.com/english/advisories/2010/0839	vdb-entry x_refsource_VUPEN x_transferred
http://cvs.openssl.org/chngview?cn=19374	x_refsource_CONFIRM x_transferred
http://marc.info/?l=bugtraq&m=127557640302499&w=2	vendor-advisory x_refsource_HP x_transferred
http://www.mandriva.com/security/advisories?name=MDVSA-2010:076	vendor-advisory x_refsource_MANDRIVA x_transferred
http://marc.info/?l=bugtraq&m=127128920008563&w=2	vendor-advisory x_refsource_HP x_transferred
https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000102.html	mailing-list x_refsource_MLIST x_transferred
http://secunia.com/advisories/39932	third-party-advisory x_refsource_SECUNIA x_transferred
http://www.openssl.org/news/changelog.html	x_refsource_CONFIRM x_transferred
http://www.vupen.com/english/advisories/2010/0933	vdb-entry x_refsource_VUPEN x_transferred
http://www.vmware.com/security/advisories/VMSA-2011-0003.html	x_refsource_CONFIRM x_transferred
http://marc.info/?l=bugtraq&m=127128920008563&w=2	vendor-advisory x_refsource_HP x_transferred
https://kb.bluecoat.com/index?page=content&id=SA50	x_refsource_CONFIRM x_transferred
http://www.securityfocus.com/archive/1/516397/100/0/threaded	mailing-list x_refsource_BUGTRAQ x_transferred
http://secunia.com/advisories/43311	third-party-advisory x_refsource_SECUNIA x_transferred
http://www.vupen.com/english/advisories/2010/1216	vdb-entry x_refsource_VUPEN x_transferred
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6718	vdb-entry signature x_refsource_OVAL x_transferred
http://secunia.com/advisories/42733	third-party-advisory x_refsource_SECUNIA x_transferred
http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038587.html	vendor-advisory x_refsource_FEDORA x_transferred
http://aix.software.ibm.com/aix/efixes/security/openssl_advisory.asc	x_refsource_CONFIRM x_transferred
http://groups.google.com/group/mailing.openssl.users/browse_thread/thread/c3e1ab0034ca4b4c/66aa896c3a78b2f7	x_refsource_MISC x_transferred