CVE-2009-0845

Published: Mar 27, 2009Modified: Apr 23, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

The spnego_gss_accept_sec_context function in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.5 through 1.6.3, when SPNEGO is used, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via invalid ContextFlags data in the reqFlags field in a negTokenInit token.

Affected (8)

Products: Mit: Kerberos, Kerberos 5

Mit

2 products

Kerberos

Kerberos 5

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Mit Kerberos	Version 5-1.6.3
Mit Kerberos 5	Version 1.5.1
Mit Kerberos 5	Version 1.5.2
Mit Kerberos 5	Version 1.5.3
Mit Kerberos 5	Version 1.5
Mit Kerberos 5	Version 1.6.1
Mit Kerberos 5	Version 1.6.2
Mit Kerberos 5	Version 1.6

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (88)

http://krbdev.mit.edu/rt/Ticket/Display.html?user=guest&pass=guest&id=6402

Source: cve@mitre.org

http://lists.apple.com/archives/security-announce/2009/May/msg00002.html

Source: cve@mitre.org

http://secunia.com/advisories/34347

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/34594

Source: cve@mitre.org

http://secunia.com/advisories/34617

Source: cve@mitre.org

http://secunia.com/advisories/34622

Source: cve@mitre.org

http://secunia.com/advisories/34628

Source: cve@mitre.org

http://secunia.com/advisories/34630

Source: cve@mitre.org

http://secunia.com/advisories/34637

Source: cve@mitre.org

http://secunia.com/advisories/34640

Source: cve@mitre.org

http://secunia.com/advisories/34734

Source: cve@mitre.org

http://secunia.com/advisories/35074

Source: cve@mitre.org

Vendor Advisory

http://security.gentoo.org/glsa/glsa-200904-09.xml

Source: cve@mitre.org

http://src.mit.edu/fisheye/browse/krb5/trunk/src/lib/gssapi/spnego/spnego_mech.c?r1=21875&r2=22084

Source: cve@mitre.org

Exploit

http://src.mit.edu/fisheye/changelog/krb5/?cs=22084

Source: cve@mitre.org

Vendor Advisory

http://sunsolve.sun.com/search/document.do?assetkey=1-26-256728-1

Source: cve@mitre.org

http://support.apple.com/kb/HT3549

Source: cve@mitre.org

http://support.avaya.com/elmodocs2/security/ASA-2009-142.htm

Source: cve@mitre.org

http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5047180.html

Source: cve@mitre.org

http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5047181.html

Source: cve@mitre.org

http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2009-001.txt

Source: cve@mitre.org

http://wiki.rpath.com/Advisories:rPSA-2009-0058

Source: cve@mitre.org

http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0058

Source: cve@mitre.org

http://www-01.ibm.com/support/docview.wss?uid=swg21396120

Source: cve@mitre.org

http://www.kb.cert.org/vuls/id/662091

Source: cve@mitre.org

US Government Resource

http://www.mandriva.com/security/advisories?name=MDVSA-2009:082

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2009-0408.html

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/502526/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/502546/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/34257

Source: cve@mitre.org

http://www.securitytracker.com/id?1021867

Source: cve@mitre.org

http://www.ubuntu.com/usn/usn-755-1

Source: cve@mitre.org

http://www.us-cert.gov/cas/techalerts/TA09-133A.html

Source: cve@mitre.org

US Government Resource

http://www.vupen.com/english/advisories/2009/0847

Source: cve@mitre.org

Vendor Advisory

http://www.vupen.com/english/advisories/2009/0976

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2009/1057

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2009/1106

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2009/1297

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2009/2248

Source: cve@mitre.org

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/49448

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10044

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6449

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00205.html

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00206.html

Source: cve@mitre.org

http://krbdev.mit.edu/rt/Ticket/Display.html?user=guest&pass=guest&id=6402