CVE - CVE-2004-0112

CVE-ID
CVE-2004-0112	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that causes an out-of-bounds read.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
BUGTRAQ:20040317 New OpenSSL releases fix denial of service attacks [17 March 2004] URL:http://marc.info/?l=bugtraq&m=107953412903636&w=2 CONFIRM:http://www.openssl.org/news/secadv_20040317.txt MISC:http://www.uniras.gov.uk/vuls/2004/224012/index.htm APPLE:APPLE-SA-2005-08-15 URL:http://lists.apple.com/archives/security-announce/2005/Aug/msg00000.html APPLE:APPLE-SA-2005-08-17 URL:http://lists.apple.com/archives/security-announce/2005//Aug/msg00001.html CISCO:20040317 Cisco OpenSSL Implementation Vulnerability URL:http://www.cisco.com/warp/public/707/cisco-sa-20040317-openssl.shtml CONECTIVA:CLA-2004:834 URL:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000834 GENTOO:GLSA-200403-03 URL:http://security.gentoo.org/glsa/glsa-200403-03.xml MANDRAKE:MDKSA-2004:023 URL:http://www.mandriva.com/security/advisories?name=MDKSA-2004:023 NETBSD:NetBSD-SA2004-005 URL:ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-005.txt.asc REDHAT:RHSA-2004:120 URL:http://www.redhat.com/support/errata/RHSA-2004-120.html REDHAT:RHSA-2004:121 URL:http://www.redhat.com/support/errata/RHSA-2004-121.html SCO:SCOSA-2004.10 URL:ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2004.10/SCOSA-2004.10.txt SLACKWARE:SSA:2004-077 URL:http://www.slackware.org/security/viewer.php?l=slackware-security&y=2004&m=slackware-security.455961 SUSE:SuSE-SA:2004:007 URL:http://www.novell.com/linux/security/advisories/2004_07_openssl.html SUNALERT:57524 URL:http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/57524 TRUSTIX:2004-0012 URL:http://www.trustix.org/errata/2004/0012 HP:SSRT4717 URL:http://marc.info/?l=bugtraq&m=108403806509920&w=2 CONFIRM:http://docs.info.apple.com/article.html?artnum=61798 CONFIRM:http://lists.apple.com/mhonarc/security-announce/msg00045.html CERT:TA04-078A URL:http://www.us-cert.gov/cas/techalerts/TA04-078A.html CERT-VN:VU#484726 URL:http://www.kb.cert.org/vuls/id/484726 CIAC:O-101 URL:http://www.ciac.org/ciac/bulletins/o-101.shtml BID:9899 URL:http://www.securityfocus.com/bid/9899 OVAL:oval:org.mitre.oval:def:1049 URL:https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1049 OVAL:oval:org.mitre.oval:def:928 URL:https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A928 OVAL:oval:org.mitre.oval:def:9580 URL:https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9580 SECUNIA:11139 URL:http://secunia.com/advisories/11139 XF:openssl-kerberos-ciphersuites-dos(15508) URL:https://exchange.xforce.ibmcloud.com/vulnerabilities/15508
Assigning CNA
N/A
Date Entry Created
20040202	Disclaimer: The entry creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20040202)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an entry on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: cve@mitre.org

Use of the Common Vulnerabilities and Exposures (CVE®) List and the associated references from this website are subject to the terms of use. CVE is sponsored by US-CERT in the office of Cybersecurity and Communications at the U.S. Department of Homeland Security. Copyright © 1999–2018, The MITRE Corporation. CVE and the CVE logo are registered trademarks of The MITRE Corporation. For more information, please contact us.