The kssl_keytab_is_available function in ssl/kssl.c in OpenSSL before 0.9.8n, when Kerberos is enabled but Kerberos configuration files cannot be opened, does not check a certain return value, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via SSL cipher negotiation, as demonstrated by a chroot installation of Dovecot or stunnel without Kerberos configuration files inside the chroot.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade openssl-develUpgrade openssl-perlUpgrade openssl | Dec 1, 2016 | Mar 5, 2010 |
| Gentoo Linux | — | Upgrade dev-libs/openssl. | Oct 30, 2017 | Mar 5, 2010 |
| Hpux | — | Update openssl.OPENSSL-SRC to the latest versionUpdate openssl.OPENSSL-MAN to the latest versionUpdate openssl.OPENSSL-MIS to the latest versionUpdate openssl.OPENSSL-CER to the latest versionUpdate openssl.OPENSSL-CONF to the latest versionUpdate openssl.OPENSSL-LIB to the latest versionUpdate openssl.OPENSSL-RUN to the latest versionUpdate openssl.OPENSSL-PVT to the latest versionUpdate openssl.OPENSSL-INC to the latest versionUpdate openssl.OPENSSL-PRNG to the latest versionUpdate openssl.OPENSSL-DOC to the latest version | Aug 11, 2017 | Mar 5, 2010 |
| Http Openssl | — | Upgrade to the latest version of OpenSSL | Sep 16, 2010 | Mar 5, 2010 |
| Ibm Aix | — | Apply the fix or workaround for openssl_advisory | Nov 30, 2017 | Mar 5, 2010 |
| Oracle_linux | — | Upgrade openssl-develUpgrade opensslUpgrade openssl-perl | Oct 16, 2024 | Mar 5, 2010 |
| Vmsa 2010 0015 | — | Upgrade VMware ESX 4.0 to build number 294855Upgrade VMware ESX 4.1 to build number 320092 | Nov 19, 2010 | Mar 5, 2010 |
| Vmsa 2010 0018 | — | Apply ESX400-201009401-SG. | Feb 16, 2011 | Mar 5, 2010 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub