Executive Summary

Informations
Name	CVE-2004-0644	First vendor Publication	2004-09-28
Vendor	Cve	Last vendor Modification	2010-08-21

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:P)
Cvss Base Score	5	Attack Range	Network
Cvss Impact Score	2.9	Attack Complexity	Low
Cvss Expoit Score	10	Authentification	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

The asn1buf_skiptail function in the ASN.1 decoder library for MIT Kerberos 5 (krb5) 1.2.2 through 1.3.4 allows remote attackers to cause a denial of service (infinite loop) via a certain BER encoding.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0644

OVAL Definitions

 

Definition Id: oval:org.mitre.oval:def:2139
Oval ID:	oval:org.mitre.oval:def:2139
Title:	Kerberos 5 ASN.1 Library DoS
Description:	The asn1buf_skiptail function in the ASN.1 decoder library for MIT Kerberos 5 (krb5) 1.2.2 through 1.3.4 allows remote attackers to cause a denial of service (infinite loop) via a certain BER encoding.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2004-0644	Version:	1
Platform(s):	Sun Solaris 9	Product(s):	Kerberos5
Definition Synopsis:
Software section Solaris 9 Installed AND Kerberos 5 installed AND NOT Patch 112908-15 or later installed AND Configuration section /etc/krb5/krb5.conf is configured with a kerberos domain

 

Definition Id: oval:org.mitre.oval:def:10014
Oval ID:	oval:org.mitre.oval:def:10014
Title:	The asn1buf_skiptail function in the ASN.1 decoder library for MIT Kerberos 5 (krb5) 1.2.2 through 1.3.4 allows remote attackers to cause a denial of service (infinite loop) via a certain BER encoding.
Description:	The asn1buf_skiptail function in the ASN.1 decoder library for MIT Kerberos 5 (krb5) 1.2.2 through 1.3.4 allows remote attackers to cause a denial of service (infinite loop) via a certain BER encoding.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2004-0644	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3	Product(s):
Definition Synopsis:
RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND Configuration section krb5-workstation is earlier than 0:1.2.7-28 AND krb5 is earlier than 0:1.2.7-28 AND krb5-libs is earlier than 0:1.2.7-28 AND krb5-server is earlier than 0:1.2.7-28 AND krb5-devel is earlier than 0:1.2.7-28

CPE : Common Platform Enumeration

Type	Description	Count
Application	Mit Kerberos cpe:/a:mit:kerberos:5-1.3.4 cpe:/a:mit:kerberos:5-1.3.3 cpe:/a:mit:kerberos:5-1.3.2 cpe:/a:mit:kerberos:5-1.3.1 cpe:/a:mit:kerberos:5-1.3:alpha1 cpe:/a:mit:kerberos:5-1.3 cpe:/a:mit:kerberos:5-1.2.8 cpe:/a:mit:kerberos:5-1.2.7 cpe:/a:mit:kerberos:5-1.2.6 cpe:/a:mit:kerberos:5-1.2.5 cpe:/a:mit:kerberos:5-1.2.4 cpe:/a:mit:kerberos:5-1.2.3 cpe:/a:mit:kerberos:5-1.2.2	13

Open Source Vulnerability Database (OSVDB)

id	Description
9406	MIT Kerberos 5 ASN.1 Decoder DoS

Internal Sources (Detail)

Source	Url
BID	http://www.securityfocus.com/bid/11079
BUGTRAQ	http://marc.theaimsgroup.com/?l=bugtraq&m=109508872524753&w=2
CERT	http://www.us-cert.gov/cas/techalerts/TA04-247A.html
CERT-VN	http://www.kb.cert.org/vuls/id/550464
CONECTIVA	http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000860
CONFIRM	http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2004-003-asn1.txt
DEBIAN	http://www.debian.org/security/2004/dsa-543
GENTOO	http://www.gentoo.org/security/en/glsa/glsa-200409-09.xml
REDHAT	http://rhn.redhat.com/errata/RHSA-2004-350.html
TRUSTIX	http://www.trustix.net/errata/2004/0045/
XF	http://xforce.iss.net/xforce/xfdb/17160

Alert History

Date	Informations
2013-05-11 11:42:12	Multiple Updates