CVE-2023-25565: GSS-NTLMSSP vulnerable to incorrect free when decoding target information
GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, an incorrect free when decoding target information can trigger a denial of service. The error condition incorrectly assumes the cb and sh buffers contain a copy of the data that needs to be freed. However, that is not the case. This vulnerability can be triggered via the main gssacceptseccontext entry point. This will likely trigger an assertion failure in free, causing a denial-of-service. This issue is fixed in version 1.2.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-25565?
CVE-2023-25565 has been classified as a denial of service vulnerability, impacting the availability of the affected system.
How do I fix CVE-2023-25565?
To address CVE-2023-25565, upgrade to version 1.2.0 or later of the GSS-NTLMSSP library.
What versions are affected by CVE-2023-25565?
CVE-2023-25565 affects versions of GSS-NTLMSSP prior to 1.2.0.
What causes the CVE-2023-25565 vulnerability?
CVE-2023-25565 is caused by an incorrect memory management issue when decoding target information.
Can CVE-2023-25565 be exploited remotely?
Yes, CVE-2023-25565 can potentially be exploited remotely, leading to a denial of service.