CVE Feed

Dashboard / CVE / CVE-2009-0846

CVE-2009-0846

The asn1_decode_generaltime function in lib/krb5/asn.1/asn1_decode.c in the ASN.1 GeneralizedTime decoder in MIT Kerberos 5 (aka krb5) before 1.6.4 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via vectors involving an invalid DER encoding that triggers a free of an uninitialized pointer.

Published:Apr 7, 2009

Last Modified:Apr 23, 2026

EPS:Apr 9, 2009

EPSS Score:0.50005

CVSS Score:10

Affected Products

Vendor

Product

Action

Vendor

Apple

Product

Mac Os X

Apple

Mac Os X

Vendor

Canonical

Product

Ubuntu Linux

Canonical

Ubuntu Linux

Vendor

Fedoraproject

Product

Fedora

Fedoraproject

Fedora

Vendor

Mit

Product

Kerberos 5

Mit

Kerberos 5

Vendor

Redhat

Product

Enterprise Linux

Redhat

Enterprise Linux

Vendor

Redhat

Product

Enterprise Linux Desktop

Redhat

Enterprise Linux Desktop

Vendor

Redhat

Product

Enterprise Linux Eus

Redhat

Enterprise Linux Eus

Vendor

Redhat

Product

Enterprise Linux Server

Redhat

Enterprise Linux Server

Vendor

Redhat

Product

Enterprise Linux Workstation

Redhat

Enterprise Linux Workstation

Exploits

No exploit reference

Common Weakness Enumeration

CWE-416 Use After Free

CWE-456 Missing Initialization of a Variable

CWE-824 Access of Uninitialized Pointer

Common Attack Pattern Enumeration and Classification (CAPEC)

No CAPEC recorded yet

Related CVEs

CVE-2024-41868 (CVSS 5.5) — Audition versions 24.4.1, 23.6.6 and earlier are affected by an out-of-bounds read vulnerability that could le…

CVE-2024-39378 (CVSS 7.8) — Audition versions 24.4.1, 23.6.6 and earlier are affected by an out-of-bounds write vulnerability that could r…

CVE-2021-3187 (CVSS 8.8) — An issue was discovered in BeyondTrust Privilege Management for Mac before 5.7. An authenticated, unprivileged…

CVE-2023-34045 (CVSS 6.6) — VMware Fusion(13.x prior to 13.5) contains a local privilege escalation vulnerability that occurs during inst…

CVE-2023-34046 (CVSS 6.7) — VMware Fusion(13.x prior to 13.5) contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs dur…

CVE-2023-34044 (CVSS 7.1) — VMware Workstation( 17.x prior to 17.5) and Fusion(13.x prior to 13.5) contain an out-of-bounds read vulnerab…

CVE-2022-46706 (CVSS 7.8) — A type confusion issue was addressed with improved state handling. This issue is fixed in Security Update 2022…

CVE-2022-22630 (CVSS 9.8) — A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur 11.…

CVE-2023-1763 (CVSS 6.5) — Canon IJ Network Tool/Ver.4.7.5 and earlier (supported OS: OS X 10.9.5-macOS 13),IJ Network Tool/Ver.4.7.3 and…

CVE-2023-1764 (CVSS 6.5) — Canon IJ Network Tool/Ver.4.7.5 and earlier (supported OS: OS X 10.9.5-macOS 13),IJ Network Tool/Ver.4.7.3 and…

References

http://lists.apple.com/archives/security-announce/2009/May/msg00002.html

http://lists.vmware.com/pipermail/security-announce/2009/000059.html

http://marc.info/?l=bugtraq&m=124896429301168&w=2

http://marc.info/?l=bugtraq&m=130497213107107&w=2

http://rhn.redhat.com/errata/RHSA-2009-0409.html

http://rhn.redhat.com/errata/RHSA-2009-0410.html

http://secunia.com/advisories/34594

http://secunia.com/advisories/34598

http://secunia.com/advisories/34617

http://secunia.com/advisories/34622

http://secunia.com/advisories/34628

http://secunia.com/advisories/34630

http://secunia.com/advisories/34637

http://secunia.com/advisories/34640

http://secunia.com/advisories/34734

http://secunia.com/advisories/35074

http://secunia.com/advisories/35667

http://security.gentoo.org/glsa/glsa-200904-09.xml

http://sunsolve.sun.com/search/document.do?assetkey=1-26-256728-1

http://support.apple.com/kb/HT3549

http://support.avaya.com/elmodocs2/security/ASA-2009-142.htm

http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5047180.html

http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5047181.html

http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2009-002.txt

http://wiki.rpath.com/Advisories:rPSA-2009-0058

http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0058

http://www-01.ibm.com/support/docview.wss?uid=swg21396120

http://www.kb.cert.org/vuls/id/662091

http://www.mandriva.com/security/advisories?name=MDVSA-2009:098

http://www.redhat.com/support/errata/RHSA-2009-0408.html

http://www.securityfocus.com/archive/1/502527/100/0/threaded

http://www.securityfocus.com/archive/1/502546/100/0/threaded

http://www.securityfocus.com/archive/1/504683/100/0/threaded

http://www.securityfocus.com/bid/34409

http://www.securitytracker.com/id?1021994

http://www.ubuntu.com/usn/usn-755-1

http://www.us-cert.gov/cas/techalerts/TA09-133A.html

http://www.vmware.com/security/advisories/VMSA-2009-0008.html

http://www.vupen.com/english/advisories/2009/0960

http://www.vupen.com/english/advisories/2009/0976

http://www.vupen.com/english/advisories/2009/1057

http://www.vupen.com/english/advisories/2009/1106

http://www.vupen.com/english/advisories/2009/1297

http://www.vupen.com/english/advisories/2009/2084

http://www.vupen.com/english/advisories/2009/2248

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10694

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5483

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6301

https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00205.html

https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00206.html

http://lists.apple.com/archives/security-announce/2009/May/msg00002.html

http://lists.vmware.com/pipermail/security-announce/2009/000059.html

http://marc.info/?l=bugtraq&m=124896429301168&w=2

http://marc.info/?l=bugtraq&m=130497213107107&w=2

http://rhn.redhat.com/errata/RHSA-2009-0409.html

http://rhn.redhat.com/errata/RHSA-2009-0410.html

http://secunia.com/advisories/34594

http://secunia.com/advisories/34598

http://secunia.com/advisories/34617

http://secunia.com/advisories/34622

http://secunia.com/advisories/34628

http://secunia.com/advisories/34630

http://secunia.com/advisories/34637

http://secunia.com/advisories/34640

http://secunia.com/advisories/34734

http://secunia.com/advisories/35074

http://secunia.com/advisories/35667

http://security.gentoo.org/glsa/glsa-200904-09.xml

http://sunsolve.sun.com/search/document.do?assetkey=1-26-256728-1

http://support.apple.com/kb/HT3549

http://support.avaya.com/elmodocs2/security/ASA-2009-142.htm

http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5047180.html

http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5047181.html

http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2009-002.txt

http://wiki.rpath.com/Advisories:rPSA-2009-0058

http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0058

http://www-01.ibm.com/support/docview.wss?uid=swg21396120

http://www.kb.cert.org/vuls/id/662091

http://www.mandriva.com/security/advisories?name=MDVSA-2009:098

http://www.redhat.com/support/errata/RHSA-2009-0408.html

http://www.securityfocus.com/archive/1/502527/100/0/threaded

http://www.securityfocus.com/archive/1/502546/100/0/threaded

http://www.securityfocus.com/archive/1/504683/100/0/threaded

http://www.securityfocus.com/bid/34409

http://www.securitytracker.com/id?1021994

http://www.ubuntu.com/usn/usn-755-1

http://www.us-cert.gov/cas/techalerts/TA09-133A.html

http://www.vmware.com/security/advisories/VMSA-2009-0008.html

http://www.vupen.com/english/advisories/2009/0960

http://www.vupen.com/english/advisories/2009/0976

http://www.vupen.com/english/advisories/2009/1057

http://www.vupen.com/english/advisories/2009/1106

http://www.vupen.com/english/advisories/2009/1297

http://www.vupen.com/english/advisories/2009/2084

http://www.vupen.com/english/advisories/2009/2248

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10694

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5483

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6301

https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00205.html

https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00206.html

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High