CVE-2009-0846

Advisory lineage Upstream: 0 Downstream: 6
Modified
Published: 09 Apr 2009, 00:00
Last modified:07 Aug 2024, 04:48

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
10 HIGH
v2.0 (nvd)
EPSS Score
50.01% CRITICAL
50% probability -8.07%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

09 Apr 2009, 00:00
Published
Vulnerability first disclosed
07 Aug 2024, 04:48
Last Modified
Vulnerability information updated

Description

The asn1_decode_generaltime function in lib/krb5/asn.1/asn1_decode.c in the ASN.1 GeneralizedTime decoder in MIT Kerberos 5 (aka krb5) before 1.6.4 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via vectors involving an invalid DER encoding that triggers a free of an uninitialized pointer.

CVSS Metrics

  • v2.0•HIGH•Score: 10AV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS Trends

Current EPSS score: 50.01%• Percentile: 98%

Techniques & Countermeasures

  • CWE-824•Access of Uninitialized Pointer

    The product accesses or uses a pointer that has not been initialized.

Affected Systems

  • apple•mac_os_x

    < 10.5.7

  • canonical•ubuntu_linux

    6.06 | 7.10 | 8.04 | 8.10

  • fedoraproject•fedora

    9 | 10

  • mit•kerberos_5

    < 1.6.4

  • redhat•enterprise_linux

    4.0

  • redhat•enterprise_linux_desktop

    3.0 | 4.0

  • redhat•enterprise_linux_eus

    4.7

  • redhat•enterprise_linux_server

    2.0 | 3.0 | 4.0

  • redhat•enterprise_linux_workstation

    2.0 | 3.0 | 4.0

References (50)