CVE-2004-0112
- State
- Published
- Severity
- Not scored
- Published
- Mar 18, 2004
- Updated
- Aug 8, 2024
- Reserved
- Feb 2, 2004
Description
The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that causes an out-of-bounds read.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 9899vdb-entry
- SSRT4717vendor-advisory
- RHSA-2004:121vendor-advisory
- MDKSA-2004:023vendor-advisory
- CLA-2004:834vendor-advisory
- http://www.uniras.gov.uk/vuls/2004/224012/index.htm
- 57524vendor-advisory
- SuSE-SA:2004:007vendor-advisory
- http://lists.apple.com/mhonarc/security-announce/msg00045.html
- http://www.openssl.org/news/secadv_20040317.txt
- O-101third-party-advisorygovernment-resource
- TA04-078Athird-party-advisory
- oval:org.mitre.oval:def:1049vdb-entrysignature
- openssl-kerberos-ciphersuites-dos(15508)vdb-entry
- VU#484726third-party-advisory
- GLSA-200403-03vendor-advisory
- oval:org.mitre.oval:def:9580vdb-entrysignature
- 11139third-party-advisory
- RHSA-2004:120vendor-advisory
- 20040317 New OpenSSL releases fix denial of service attacks [17 March 2004]mailing-list
- APPLE-SA-2005-08-15vendor-advisory
- SSA:2004-077vendor-advisory
- 2004-0012vendor-advisory
- 20040317 Cisco OpenSSL Implementation Vulnerabilityvendor-advisory
- http://docs.info.apple.com/article.html?artnum=61798
- APPLE-SA-2005-08-17vendor-advisory
- oval:org.mitre.oval:def:928vdb-entrysignature
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.