CVE-2009-0847: Medium severity MIT Kerberos vulnerability
Published Apr 9, 2009
·Updated
The asn1bufimbed function in the ASN.1 decoder in MIT Kerberos 5 (aka krb5) 1.6.3, when PK-INIT is used, allows remote attackers to cause a denial of service (application crash) via a crafted length value that triggers an erroneous malloc call, related to incorrect calculations with pointer arithmetic.
Affected Software
1 affected component
MIT Kerberos=5-1.6.3
Event History
Apr 9, 2009
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2009-0847?
CVE-2009-0847 is classified as a denial of service vulnerability.
2
How do I fix CVE-2009-0847?
To fix CVE-2009-0847, upgrade to a later version of MIT Kerberos that addresses this vulnerability.
3
What are the consequences of exploiting CVE-2009-0847?
Exploiting CVE-2009-0847 can lead to an application crash, resulting in a denial of service.
4
Which versions of MIT Kerberos are affected by CVE-2009-0847?
MIT Kerberos version 5-1.6.3 is affected by CVE-2009-0847.
5
What is the cause of CVE-2009-0847?
CVE-2009-0847 occurs due to incorrect calculations with pointer arithmetic when a crafted length value is used.