CVE-2009-0846: Input Validation
The asn1decodegeneraltime function in lib/krb5/asn.1/asn1decode.c in the ASN.1 GeneralizedTime decoder in MIT Kerberos 5 (aka krb5) before 1.6.4 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via vectors involving an invalid DER encoding that triggers a free of an uninitialized pointer.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2009-0846?
CVE-2009-0846 has been classified with a critical severity level due to its potential to cause a denial of service or allow arbitrary code execution.
How do I fix CVE-2009-0846?
To resolve CVE-2009-0846, upgrade your MIT Kerberos installation to version 1.6.4 or later, which addresses this vulnerability.
What are the affected versions for CVE-2009-0846?
CVE-2009-0846 affects MIT Kerberos versions before 1.6.4, including various earlier versions such as 5-1.6.3, 1.5.3, and others.
What are the potential impacts of CVE-2009-0846?
The potential impacts of CVE-2009-0846 include daemon crashes and possible execution of arbitrary code by remote attackers.
Which systems are primarily affected by CVE-2009-0846?
CVE-2009-0846 primarily affects systems running MIT Kerberos 5, particularly those on platforms like Fedora, Ubuntu, and Red Hat.