Vulnerability in Apple Mac Os X
CVE-2009-0846
The asn1_decode_generaltime function in lib/krb5/asn.1/asn1_decode.c in the ASN.1 GeneralizedTime decoder in MIT Kerberos 5 (aka krb5) before 1.6.4 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via vectors involving an invalid DER encoding that triggers a free of an uninitialized pointer.
EPSS: 0.089 (94.7th percentile) — read the EPSS interpretation.
Affected products
- Apple Mac_os_x
- Mit Kerberos_5
- Canonical Ubuntu_linux — versions 6.06, 7.10, 8.04
- Fedoraproject Fedora — versions 9, 10
- Redhat Enterprise_linux — versions 4.0
- Redhat Enterprise_linux_desktop — versions 3.0, 4.0
- Redhat Enterprise_linux_eus — versions 4.7
- Redhat Enterprise_linux_server — versions 2.0, 3.0, 4.0
- Redhat Enterprise_linux_workstation — versions 2.0, 3.0, 4.0
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ, VDB Entry, Third Party Advisory, Broken Link)
- cve@mitre.org (x_refsource_MISC, Broken Link)
- cve@mitre.org (Broken Link, signature, x_refsource_OVAL, vdb-entry)
- cve@mitre.org (vendor-advisory, x_refsource_MANDRIVA, Broken Link)
- cve@mitre.org (US Government Resource, x_refsource_CERT-VN, Third Party Advisory, Broken Link, third-party-advisory)
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ, VDB Entry, Third Party Advisory, Broken Link)
- cve@mitre.org (vdb-entry, Broken Link, x_refsource_VUPEN)
- cve@mitre.org (x_refsource_CONFIRM, Third Party Advisory)
- cve@mitre.org (x_refsource_CONFIRM, Third Party Advisory)
- cve@mitre.org (x_refsource_SECUNIA, Broken Link, third-party-advisory)