CVE-2010-0433: Input Validation
The ksslkeytabisavailable function in ssl/kssl.c in OpenSSL before 0.9.8n, when Kerberos is enabled but Kerberos configuration files cannot be opened, does not check a certain return value, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via SSL cipher negotiation, as demonstrated by a chroot installation of Dovecot or stunnel without Kerberos configuration files inside the chroot.
Other sources
Todd Rinaldo brought to our attention (bug #567711) a flaw in OpenSSL that can cause TLS/SSL server using OpenSSL to crash when clients proposes certain cipher suites in its client hello.
This crash is caused by a missing kerberos krb5snametoprincipal() function return value check in OpenSSL's ksslkeytabisavailable() (ssl/kssl.c). This function can return an error under certain circumstances (the issue was reproduced with dovecot and stunnel configured to chroot their process to an empty directory, causing getaddrinfo() call to fail). If ksslkeytabisavailable() fails, it may leave princ (kerberos service principal) unmodified, causing krb5ktgetentry() to be called with NULL principal. With certain krb5 versions, this leads to a NULL pointer dereference crash.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-0433?
CVE-2010-0433 is classified as a denial of service vulnerability due to a NULL pointer dereference.
How do I fix CVE-2010-0433?
To fix CVE-2010-0433, upgrade OpenSSL to version 0.9.8n or later.
Who is affected by CVE-2010-0433?
CVE-2010-0433 affects all versions of OpenSSL prior to 0.9.8n with Kerberos enabled.
What types of attacks can exploit CVE-2010-0433?
CVE-2010-0433 can be exploited by remote attackers to crash the daemon by causing a denial of service.
Is there a workaround for CVE-2010-0433?
Currently, the recommended action for CVE-2010-0433 is to upgrade the OpenSSL library to eliminate the risk.