CVE-2023-25566: GSS-NTLMSSP vulnerable to memory leak when parsing usernames
GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, a memory leak can be triggered when parsing usernames which can trigger a denial-of-service. The domain portion of a username may be overridden causing an allocated memory area the size of the domain name to be leaked. An attacker can leak memory via the main gssacceptseccontext entry point, potentially causing a denial-of-service. This issue is fixed in version 1.2.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-25566?
CVE-2023-25566 is a vulnerability in the GSS-NTLMSSP plugin for the GSSAPI library that allows a memory leak and denial-of-service when parsing usernames with an overridden domain portion.
What is the severity level of CVE-2023-25566?
CVE-2023-25566 has a severity level of 7.5, which is considered high.
How does CVE-2023-25566 affect software?
CVE-2023-25566 affects GSS-NTLMSSP versions up to 1.2.0.
How can I fix CVE-2023-25566?
To fix CVE-2023-25566, update GSS-NTLMSSP to version 1.2.0 or later.
What is the CWE ID for CVE-2023-25566?
The CWE ID for CVE-2023-25566 is 401.