CVE-2010-0433

原文の説明

The kssl_keytab_is_available function in ssl/kssl.c in OpenSSL before 0.9.8n, when Kerberos is enabled but Kerberos configuration files cannot be opened, does not check a certain return value, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via SSL cipher negotiation, as demonstrated by a chroot installation of Dovecot or stunnel without Kerberos configuration files inside the chroot.

影響を受けるソフトウェア

• OpenSSL = 0.9.8a= 0.9.8d= 0.9.8l= 0.9.8b= 0.9.8c= 0.9.8i 完全一致

詳細

公開日

2010-03-05

最終更新

2026-06-16

CVSS ベクター

AV:N/AC:M/Au:N/C:N/I:N/A:P

CWE

CWE-20

参考資料

• cve.org/CVE-2010-0433
• nvd.nist.gov/vuln/detail/CVE-2010-0433
• aix.software.ibm.com/aix/efixes/security/openssl_advisory.asc
• cvs.openssl.org/chngview?cn=19374
• groups.google.com/group/mailing.openssl.users/browse_thread/thread/c3e1ab0034ca4b4c/66aa89...
• lists.fedoraproject.org/pipermail/package-announce/2010-April/038587.html
• lists.fedoraproject.org/pipermail/package-announce/2010-April/039561.html
• marc.info/?l=bugtraq&m=127128920008563&w=2
• marc.info/?l=bugtraq&m=127557640302499&w=2
• secunia.com/advisories/39461
• secunia.com/advisories/39932
• secunia.com/advisories/42724
• secunia.com/advisories/42733
• secunia.com/advisories/43311