CVE-2009-0844: Buffer Overflow
Published Apr 9, 2009
·Updated
The getinputtoken function in the SPNEGO implementation in MIT Kerberos 5 (aka krb5) 1.5 through 1.6.3 allows remote attackers to cause a denial of service (daemon crash) and possibly obtain sensitive information via a crafted length value that triggers a buffer over-read.
Affected Software
9 affected components
MIT Kerberos=5-1.6.3
MIT Kerberos 5
MIT Kerberos 5=1.5
MIT Kerberos 5=1.5.1
MIT Kerberos 5=1.5.2
MIT Kerberos 5=1.5.3
MIT Kerberos 5=1.6
MIT Kerberos 5=1.6.1
MIT Kerberos 5=1.6.2
Event History
Apr 9, 2009
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2009-0844?
CVE-2009-0844 is classified as a denial of service vulnerability that can lead to daemon crashes.
2
How do I fix CVE-2009-0844?
To fix CVE-2009-0844, upgrade to an unaffected version of MIT Kerberos 5.
3
Which versions of MIT Kerberos 5 are affected by CVE-2009-0844?
CVE-2009-0844 affects MIT Kerberos 5 versions 1.5 through 1.6.3.
4
What type of attack does CVE-2009-0844 facilitate?
CVE-2009-0844 allows remote attackers to potentially obtain sensitive information and cause service disruption.
5
Is CVE-2009-0844 related to buffer over-read vulnerabilities?
Yes, CVE-2009-0844 involves a buffer over-read triggered by a crafted length value.