CVE-2009-0846

CVE-2009-0846

Published · Updated

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 8.9%
exploitation probability
8.9%top 5% of all CVEs
observed exploitation
nono source reports it
The asn1_decode_generaltime function in lib/krb5/asn.1/asn1_decode.c in the ASN.1 GeneralizedTime decoder in MIT Kerberos 5 (aka krb5) before 1.6.4 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via vectors involving an invalid DER encoding that triggers a free of an uninitialized pointer.
Affected products
n/a · n/a
References
http://lists.apple.com/archives/security-announce/2009/May/msg00002.htmlhttp://lists.vmware.com/pipermail/security-announce/2009/000059.htmlhttp://marc.info/?l=bugtraq&m=124896429301168&w=2http://marc.info/?l=bugtraq&m=130497213107107&w=2http://rhn.redhat.com/errata/RHSA-2009-0409.htmlhttp://rhn.redhat.com/errata/RHSA-2009-0410.htmlhttp://secunia.com/advisories/34594http://secunia.com/advisories/34598http://secunia.com/advisories/34617http://secunia.com/advisories/34622http://secunia.com/advisories/34628http://secunia.com/advisories/34630