Executive Summary

Informations
Name CVE-2004-0112 First vendor Publication 2004-11-23
Vendor Cve Last vendor Modification 2024-11-20

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:P)
Cvss Base Score 5 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that causes an out-of-bounds read.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0112

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-125 Out-of-bounds Read

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:1049
 
Oval ID: oval:org.mitre.oval:def:1049
Title: Red Hat OpenSSL Kerberos Handshake Vulnerability
Description: The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that causes an out-of-bounds read.
Family: unix Class: vulnerability
Reference(s): CVE-2004-0112
 Version: 2
Platform(s): Red Hat Linux 9
 Product(s): OpenSSL
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:928
 
Oval ID: oval:org.mitre.oval:def:928
Title: Red Hat Enterprise 3 OpenSSL Kerberos Handshake Vulnerability
Description: The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that causes an out-of-bounds read.
Family: unix Class: vulnerability
Reference(s): CVE-2004-0112
 Version: 2
Platform(s): Red Hat Enterprise Linux 3
 Product(s): OpenSSL
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:9580
 
Oval ID: oval:org.mitre.oval:def:9580
Title: The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that causes an out-of-bounds read.
Description: The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that causes an out-of-bounds read.
Family: unix Class: vulnerability
Reference(s): CVE-2004-0112
 Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
 Product(s):
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 1
Application 1
Hardware 1
Hardware 2
Hardware 2
Hardware 2
Hardware 3
Hardware 5
Hardware 1
Hardware 2
Hardware 1
Os 1
Os 1
Os 8
Os 4
Os 2
Os 3
Os 1
Os 3
Os 2

OpenVAS Exploits

Date Description
2009-11-17 Name : Mac OS X Version
File : nvt/macosx_version.nasl
2009-05-05 Name : HP-UX Update for AAA Server HPSBUX01011
File : nvt/gb_hp_ux_HPSBUX01011.nasl
2009-05-05 Name : HP-UX Update for Apache HPSBUX01019
File : nvt/gb_hp_ux_HPSBUX01019.nasl
2008-09-24 Name : Gentoo Security Advisory GLSA 200403-03 (OpenSSL)
File : nvt/glsa_200403_03.nasl
0000-00-00 Name : Slackware Advisory SSA:2004-077-01 OpenSSL security update
File : nvt/esoft_slk_ssa_2004_077_01.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
4316 OpenSSL Kerberos SSL/TLS Handshake DoS

The SSL/TLS handshaking code in OpenSSL does not properly check the length of Kerberos tickets during an SSL/TLS handshake when using Kerberos ciphersuites. This allows remote attackers to cause a denial of service by manipulating the parameters during SSL/TLS handshake, causing an out-of-bounds read and crashing OpenSSL.

Nessus® Vulnerability Scanner

Date Description
2012-01-04 Name : The remote server is vulnerable to a denial of service attack.
File : openssl_0_9_6m_0_9_7d.nasl - Type : ACT_GATHER_INFO
2005-08-18 Name : The remote host is missing a Mac OS X update that fixes various security issues.
File : macosx_SecUpd2005-007.nasl - Type : ACT_GATHER_INFO
2005-07-13 Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2004-077-01.nasl - Type : ACT_GATHER_INFO
2005-03-18 Name : The remote HP-UX host is missing a security-related patch.
File : hpux_PHSS_30640.nasl - Type : ACT_GATHER_INFO
2005-03-18 Name : The remote HP-UX host is missing a security-related patch.
File : hpux_PHSS_30641.nasl - Type : ACT_GATHER_INFO
2005-03-18 Name : The remote HP-UX host is missing a security-related patch.
File : hpux_PHSS_30642.nasl - Type : ACT_GATHER_INFO
2005-03-18 Name : The remote HP-UX host is missing a security-related patch.
File : hpux_PHSS_30643.nasl - Type : ACT_GATHER_INFO
2005-03-18 Name : The remote HP-UX host is missing a security-related patch.
File : hpux_PHSS_30644.nasl - Type : ACT_GATHER_INFO
2005-03-18 Name : The remote HP-UX host is missing a security-related patch.
File : hpux_PHSS_30645.nasl - Type : ACT_GATHER_INFO
2005-03-18 Name : The remote HP-UX host is missing a security-related patch.
File : hpux_PHSS_30646.nasl - Type : ACT_GATHER_INFO
2005-03-18 Name : The remote HP-UX host is missing a security-related patch.
File : hpux_PHSS_30648.nasl - Type : ACT_GATHER_INFO
2005-03-18 Name : The remote HP-UX host is missing a security-related patch.
File : hpux_PHSS_30649.nasl - Type : ACT_GATHER_INFO
2005-03-18 Name : The remote HP-UX host is missing a security-related patch.
File : hpux_PHSS_30650.nasl - Type : ACT_GATHER_INFO
2005-02-16 Name : The remote HP-UX host is missing a security-related patch.
File : hpux_PHSS_30639.nasl - Type : ACT_GATHER_INFO
2005-02-16 Name : The remote HP-UX host is missing a security-related patch.
File : hpux_PHSS_30647.nasl - Type : ACT_GATHER_INFO
2004-08-30 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200403-03.nasl - Type : ACT_GATHER_INFO
2004-07-31 Name : The remote Mandrake Linux host is missing one or more security updates.
File : mandrake_MDKSA-2004-023.nasl - Type : ACT_GATHER_INFO
2004-07-25 Name : The remote host is missing a vendor-supplied security patch
File : suse_SA_2004_007.nasl - Type : ACT_GATHER_INFO
2004-07-06 Name : The remote host is using an unsupported version of Mac OS X.
File : macosx_version.nasl - Type : ACT_GATHER_INFO
2004-07-06 Name : The remote host is missing a Mac OS X update that fixes a security issue.
File : macosx_SecUpd20040503.nasl - Type : ACT_GATHER_INFO
2004-07-06 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2004-120.nasl - Type : ACT_GATHER_INFO
2004-03-17 Name : The remote service is prone to a denial of service attack.
File : openssl_denial.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-005.txt.asc
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2004.10/SCOSA-2004.10.txt
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000834
http://docs.info.apple.com/article.html?artnum=61798
http://lists.apple.com/archives/security-announce/2005//Aug/msg00001.html
http://lists.apple.com/archives/security-announce/2005/Aug/msg00000.html
http://lists.apple.com/mhonarc/security-announce/msg00045.html
http://marc.info/?l=bugtraq&m=107953412903636&w=2
http://marc.info/?l=bugtraq&m=108403806509920&w=2
http://secunia.com/advisories/11139
http://security.gentoo.org/glsa/glsa-200403-03.xml
http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/57524
http://www.ciac.org/ciac/bulletins/o-101.shtml
http://www.cisco.com/warp/public/707/cisco-sa-20040317-openssl.shtml
http://www.kb.cert.org/vuls/id/484726
http://www.mandriva.com/security/advisories?name=MDKSA-2004:023
http://www.novell.com/linux/security/advisories/2004_07_openssl.html
http://www.openssl.org/news/secadv_20040317.txt
http://www.redhat.com/support/errata/RHSA-2004-120.html
http://www.redhat.com/support/errata/RHSA-2004-121.html
http://www.securityfocus.com/bid/9899
http://www.slackware.org/security/viewer.php?l=slackware-security&y=2004&...
http://www.trustix.org/errata/2004/0012
http://www.uniras.gov.uk/vuls/2004/224012/index.htm
http://www.us-cert.gov/cas/techalerts/TA04-078A.html
https://exchange.xforce.ibmcloud.com/vulnerabilities/15508
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
Source Url

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
Date Informations
2024-11-28 23:22:52
  • Multiple Updates
2024-11-28 12:06:00
  • Multiple Updates
2024-08-02 12:02:45
  • Multiple Updates
2024-08-02 01:01:29
  • Multiple Updates
2024-02-16 05:28:27
  • Multiple Updates
2024-02-02 01:02:30
  • Multiple Updates
2024-02-01 12:01:30
  • Multiple Updates
2023-09-05 12:02:23
  • Multiple Updates
2023-09-05 01:01:22
  • Multiple Updates
2023-09-02 12:02:24
  • Multiple Updates
2023-09-02 01:01:22
  • Multiple Updates
2023-08-12 12:02:55
  • Multiple Updates
2023-08-12 01:01:22
  • Multiple Updates
2023-08-11 12:02:30
  • Multiple Updates
2023-08-11 01:01:23
  • Multiple Updates
2023-08-06 12:02:19
  • Multiple Updates
2023-08-06 01:01:23
  • Multiple Updates
2023-08-04 12:02:22
  • Multiple Updates
2023-08-04 01:01:23
  • Multiple Updates
2023-07-14 12:02:21
  • Multiple Updates
2023-07-14 01:01:23
  • Multiple Updates
2023-03-29 01:02:23
  • Multiple Updates
2023-03-28 12:01:28
  • Multiple Updates
2022-10-11 12:02:06
  • Multiple Updates
2022-10-11 01:01:16
  • Multiple Updates
2021-11-08 21:23:51
  • Multiple Updates
2021-05-04 12:02:16
  • Multiple Updates
2021-04-22 01:02:25
  • Multiple Updates
2020-05-23 00:15:42
  • Multiple Updates
2019-03-19 12:01:40
  • Multiple Updates
2018-10-31 00:19:43
  • Multiple Updates
2017-10-11 09:23:20
  • Multiple Updates
2017-07-11 12:01:23
  • Multiple Updates
2016-10-18 12:01:17
  • Multiple Updates
2016-06-28 15:04:55
  • Multiple Updates
2016-04-26 12:46:53
  • Multiple Updates
2014-02-17 10:27:10
  • Multiple Updates
2013-05-11 11:39:52
  • Multiple Updates