CVE-2004-0112

Fixed in a distro release EPSS 10%

The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that causes an out-of-bounds read.

Published 2004-03-18 · CVE record · OSV

Products: ciscoworks_common_management_foundation, ciscoworks_common_services, apple mac_os_x, apple mac_os_x_server, freebsd, hp-ux, openbsd, redhat enterprise_linux, redhat enterprise_linux_desktop, redhat linux, sco openserver, cisco ios, 4d webstar, avaya intuity_audix, avaya vsu, checkpoint firewall-1, checkpoint provider-1, checkpoint vpn-1, cisco access_registrar, cisco application_and_content_networking_software, cisco css_secure_content_accelerator, cisco css11000_content_services_switch, cisco okena_stormwatch, cisco pix_firewall, cisco threat_response, cisco webns, dell bsafe_ssl-j, forcepoint stonegate, hp wbem, litespeedtech litespeed_web_server, neoteris instant_virtual_extranet, novell edirectory, novell imanager, openssl, redhat openssl, sgi propack, stonesoft servercluster, stonesoft stonebeat_fullcluster, stonesoft stonebeat_securitycluster, stonesoft stonebeat_webcluster, tarantella_enterprise, vmware gsx_server, bluecoat cacheos_ca_sa, cisco pix_firewall_software

Distro releases