CVE-2004-0112

CWE-125 — Out-of-bounds ReadCWE-39910 documents8 sources
Severity
5.0MEDIUM
EPSS
0.9%
top 24.10%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
54
4D WebstarApple MAC OS XApple MAC OS X Server+51 more
Timeline
PublishedNov 23
Latest updateMay 3

Description

The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that causes an out-of-bounds read.

CVSS vector

AV:N/AC:L/C:N/I:N/A:PExploitability: 10.0 | Impact: 2.9

Affected Packages53 packages

▶Debianopenssl< 0.9.7d-1+3
▶NVDredhat/openssl0.9.6-15, 0.9.6b-3, 0.9.7a-2+2
▶NVDopenssl/openssl13 versions+12
▶NVDcheckpoint/vpn-14 versions+3
▶NVDcheckpoint/firewall-14 versions+3

Also affects: Freebsd 4.8, 4.9, 5.1, 5.2, 5.2.1, Enterprise Linux 3.0

🔴Vulnerability Details

3
GHSA
GHSA-ph6p-3j2f-xq2g: The SSL/TLS handshaking code in OpenSSL 0↗2022-05-03
▶
OSV
CVE-2004-0112: The SSL/TLS handshaking code in OpenSSL 0↗2004-11-23
▶
CVEList
CVE-2004-0112: The SSL/TLS handshaking code in OpenSSL 0↗2004-03-18
▶

📋Vendor Advisories

4
Red Hat
security flaw↗2004-03-17
▶
Cisco
Cisco OpenSSL Implementation Vulnerability↗2004-03-17
▶
Debian
CVE-2004-0112: openssl - The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using K...↗2004
▶
Red Hat
CVE-2005-1730: Multiple vulnerabilities in the OpenSSL ASN↗
▶

💬Community

1
Bugzilla
CVE-2004-0112 security flaw↗2018-08-16
▶