CVE-2009-0846

Published: Apr 9, 2009Modified: Apr 23, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

The asn1_decode_generaltime function in lib/krb5/asn.1/asn1_decode.c in the ASN.1 GeneralizedTime decoder in MIT Kerberos 5 (aka krb5) before 1.6.4 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via vectors involving an invalid DER encoding that triggers a free of an uninitialized pointer.

Affected (18)

Products: Mit: Kerberos 5 · Fedoraproject: Fedora · Canonical: Ubuntu Linux · +2 more

Show all products

Mit: Kerberos 5 · Fedoraproject: Fedora · Canonical: Ubuntu Linux · Apple: Mac Os X · Redhat: Enterprise Linux, Enterprise Linux Desktop, Enterprise Linux Eus, Enterprise Linux Server, Enterprise Linux Workstation

1 product

1 product

1 product

1 product

5 products

Enterprise Linux Desktop

Enterprise Linux Eus

Enterprise Linux Server

Enterprise Linux Workstation

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Mit Kerberos 5	Before 1.6.4

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 10
Fedoraproject Fedora	Version 9

Configuration C

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 6.06
Canonical Ubuntu Linux	Version 7.10
Canonical Ubuntu Linux	Version 8.04
Canonical Ubuntu Linux	Version 8.10

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Apple Mac Os X	Before 10.5.7

Configuration E

10 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux	Version 4.0
Redhat Enterprise Linux Desktop	Version 3.0
Redhat Enterprise Linux Desktop	Version 4.0
Redhat Enterprise Linux Eus	Version 4.7
Redhat Enterprise Linux Server	Version 2.0
Redhat Enterprise Linux Server	Version 3.0
Redhat Enterprise Linux Server	Version 4.0
Redhat Enterprise Linux Workstation	Version 2.0
Redhat Enterprise Linux Workstation	Version 3.0
Redhat Enterprise Linux Workstation	Version 4.0

Related CWEs

CWE-824

Access of Uninitialized Pointer

The product accesses or uses a pointer that has not been initialized.

References (100)

http://lists.apple.com/archives/security-announce/2009/May/msg00002.html

Source: cve@mitre.org

Mailing List

http://lists.vmware.com/pipermail/security-announce/2009/000059.html

Source: cve@mitre.org

Broken Link

http://marc.info/?l=bugtraq&m=124896429301168&w=2

Source: cve@mitre.org

Third Party Advisory

http://marc.info/?l=bugtraq&m=130497213107107&w=2

Source: cve@mitre.org

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2009-0409.html

Source: cve@mitre.org

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2009-0410.html

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/34594

Source: cve@mitre.org

Broken Link

http://secunia.com/advisories/34598

Source: cve@mitre.org

Broken Link

http://secunia.com/advisories/34617

Source: cve@mitre.org

Broken Link

http://secunia.com/advisories/34622

Source: cve@mitre.org

Broken Link

http://secunia.com/advisories/34628

Source: cve@mitre.org

Broken Link

http://secunia.com/advisories/34630

Source: cve@mitre.org

Broken Link

http://secunia.com/advisories/34637

Source: cve@mitre.org

Broken Link

http://secunia.com/advisories/34640

Source: cve@mitre.org

Broken Link

http://secunia.com/advisories/34734

Source: cve@mitre.org

Broken Link

http://secunia.com/advisories/35074

Source: cve@mitre.org

Broken Link

http://secunia.com/advisories/35667

Source: cve@mitre.org

Broken Link

http://security.gentoo.org/glsa/glsa-200904-09.xml

Source: cve@mitre.org

Third Party Advisory

http://sunsolve.sun.com/search/document.do?assetkey=1-26-256728-1

Source: cve@mitre.org

Broken Link

http://support.apple.com/kb/HT3549

Source: cve@mitre.org

Third Party Advisory

http://support.avaya.com/elmodocs2/security/ASA-2009-142.htm

Source: cve@mitre.org

Third Party Advisory

http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5047180.html

Source: cve@mitre.org

Broken Link

http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5047181.html

Source: cve@mitre.org

Broken Link

http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2009-002.txt

Source: cve@mitre.org

PatchVendor Advisory

http://wiki.rpath.com/Advisories:rPSA-2009-0058

Source: cve@mitre.org

Broken Link

http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0058

Source: cve@mitre.org

Broken Link

http://www-01.ibm.com/support/docview.wss?uid=swg21396120

Source: cve@mitre.org

Broken Link

http://www.kb.cert.org/vuls/id/662091

Source: cve@mitre.org

Broken LinkThird Party AdvisoryUS Government Resource

http://www.mandriva.com/security/advisories?name=MDVSA-2009:098

Source: cve@mitre.org

Broken Link

http://www.redhat.com/support/errata/RHSA-2009-0408.html

Source: cve@mitre.org

Broken Link

http://www.securityfocus.com/archive/1/502527/100/0/threaded

Source: cve@mitre.org

Broken LinkThird Party AdvisoryVDB Entry

http://www.securityfocus.com/archive/1/502546/100/0/threaded

Source: cve@mitre.org

Broken LinkThird Party AdvisoryVDB Entry

http://www.securityfocus.com/archive/1/504683/100/0/threaded

Source: cve@mitre.org

Broken LinkThird Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/34409

Source: cve@mitre.org

Broken LinkThird Party AdvisoryVDB Entry

http://www.securitytracker.com/id?1021994

Source: cve@mitre.org

Broken LinkThird Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/usn-755-1

Source: cve@mitre.org

Third Party Advisory

http://www.us-cert.gov/cas/techalerts/TA09-133A.html

Source: cve@mitre.org

Third Party AdvisoryUS Government Resource

http://www.vmware.com/security/advisories/VMSA-2009-0008.html

Source: cve@mitre.org

Third Party Advisory

http://www.vupen.com/english/advisories/2009/0960

Source: cve@mitre.org

Broken Link

http://www.vupen.com/english/advisories/2009/0976

Source: cve@mitre.org

Broken Link

http://www.vupen.com/english/advisories/2009/1057

Source: cve@mitre.org

Broken Link

http://www.vupen.com/english/advisories/2009/1106

Source: cve@mitre.org

Broken Link

http://www.vupen.com/english/advisories/2009/1297

Source: cve@mitre.org

Broken Link

http://www.vupen.com/english/advisories/2009/2084

Source: cve@mitre.org

Broken Link

http://www.vupen.com/english/advisories/2009/2248

Source: cve@mitre.org

Broken Link

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10694

Source: cve@mitre.org

Broken Link

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5483

Source: cve@mitre.org

Broken Link

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6301

Source: cve@mitre.org

Broken Link

https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00205.html

Source: cve@mitre.org

Mailing List

https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00206.html

Source: cve@mitre.org

Mailing List

http://lists.apple.com/archives/security-announce/2009/May/msg00002.html