CVE-2009-0844

Published: Apr 9, 2009Modified: Apr 23, 2026

5.8

Vector

AV:N/AC:M/Au:N/C:P/I:N/A:P

Exploitability: 8.6 / Impact: 4.9

Source: NVD

Description

The get_input_token function in the SPNEGO implementation in MIT Kerberos 5 (aka krb5) 1.5 through 1.6.3 allows remote attackers to cause a denial of service (daemon crash) and possibly obtain sensitive information via a crafted length value that triggers a buffer over-read.

Affected (9)

Products: Mit: Kerberos, Kerberos 5

Mit

2 products

Kerberos

Kerberos 5

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Mit Kerberos	Version 5-1.6.3
Mit Kerberos 5	All versions
Mit Kerberos 5	Version 1.5.1
Mit Kerberos 5	Version 1.5.2
Mit Kerberos 5	Version 1.5.3
Mit Kerberos 5	Version 1.5
Mit Kerberos 5	Version 1.6.1
Mit Kerberos 5	Version 1.6.2
Mit Kerberos 5	Version 1.6

Related CWEs

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (78)

http://lists.apple.com/archives/security-announce/2009/May/msg00002.html

Source: cve@mitre.org

http://secunia.com/advisories/34594

Source: cve@mitre.org

http://secunia.com/advisories/34617

Source: cve@mitre.org

http://secunia.com/advisories/34622

Source: cve@mitre.org

http://secunia.com/advisories/34628

Source: cve@mitre.org

http://secunia.com/advisories/34630

Source: cve@mitre.org

http://secunia.com/advisories/34637

Source: cve@mitre.org

http://secunia.com/advisories/34640

Source: cve@mitre.org

http://secunia.com/advisories/34734

Source: cve@mitre.org

http://secunia.com/advisories/35074

Source: cve@mitre.org

http://security.gentoo.org/glsa/glsa-200904-09.xml

Source: cve@mitre.org

http://sunsolve.sun.com/search/document.do?assetkey=1-26-256728-1

Source: cve@mitre.org

http://support.apple.com/kb/HT3549

Source: cve@mitre.org

http://support.avaya.com/elmodocs2/security/ASA-2009-142.htm

Source: cve@mitre.org

http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5047180.html

Source: cve@mitre.org

http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5047181.html

Source: cve@mitre.org

http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2009-001.txt

Source: cve@mitre.org

http://wiki.rpath.com/Advisories:rPSA-2009-0058

Source: cve@mitre.org

http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0058

Source: cve@mitre.org

http://www-01.ibm.com/support/docview.wss?uid=swg21396120

Source: cve@mitre.org

http://www.kb.cert.org/vuls/id/662091

Source: cve@mitre.org

US Government Resource

http://www.mandriva.com/security/advisories?name=MDVSA-2009:098

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2009-0408.html

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/502526/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/502546/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/34408

Source: cve@mitre.org

http://www.securitytracker.com/id?1021867

Source: cve@mitre.org

http://www.ubuntu.com/usn/usn-755-1

Source: cve@mitre.org

http://www.us-cert.gov/cas/techalerts/TA09-133A.html

Source: cve@mitre.org

US Government Resource

http://www.vupen.com/english/advisories/2009/0960

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2009/0976

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2009/1057

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2009/1106

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2009/1297

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2009/2248

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6339

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9474

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00205.html

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00206.html

Source: cve@mitre.org

http://lists.apple.com/archives/security-announce/2009/May/msg00002.html