medium5.0

CVE-2004-0112

The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets du…

Impact

The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that causes an out-of-bounds read.

Affected products

Vendor	Product	Affected versions
Cisco	Firewall Services Module	All versions Versions 1.1.2, 1.1.3, 1.1_\(3.005\), 2.1_\(0.208\)
Hp	Aaa Server	All versions
Hp	Apache-Based Web Server	Versions 2.0.43.00, 2.0.43.04
Symantec	Clientless Vpn Gateway 4400	Version 5.0
Cisco	Ciscoworks Common Management Foundation	Version 2.1
Cisco	Ciscoworks Common Services	Version 2.2
Avaya	Converged Communications Server	Version 2.0
Avaya	Sg200	Versions 4.4, 4.31.29
Avaya	Sg203	Versions 4.4, 4.31.29
Avaya	Sg208	All versions Version 4.4
Avaya	Sg5	Versions 4.2, 4.3, 4.4
Apple	Mac Os X	Version 10.3.3

Weakness classification

CWE-125

Impact

Affected products

Weakness classification

References