CVE-2009-0847

MEDIUM 4.3CVE-2009-0847 · Published 09/04/2009 · updated 16/06/2026

In short

CVE-2009-0847 is a MEDIUM (CVSS 4.3) vulnerability affecting kerberos (mit).
Chance of exploitation in the next 30 days (EPSS): 2.8%, higher than 86.3% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
kerberos mit	`= 5-1.6.3`	No fix yet

Description

The asn1buf_imbed function in the ASN.1 decoder in MIT Kerberos 5 (aka krb5) 1.6.3, when PK-INIT is used, allows remote attackers to cause a denial of service (application crash) via a crafted length value that triggers an erroneous malloc call, related to incorrect calculations with pointer arithmetic.

References

lists.apple.com/archives/security-announce/2009/May/msg00002.html
marc.info
secunia.com/advisories/34594
secunia.com/advisories/34617
secunia.com/advisories/34622
secunia.com/advisories/34628
secunia.com/advisories/34637
secunia.com/advisories/34640
secunia.com/advisories/34734
secunia.com/advisories/35074
security.gentoo.org/glsa/glsa-200904-09.xml
sunsolve.sun.com/search/document.do
support.apple.com/kb/HT3549
support.avaya.com/elmodocs2/security/ASA-2009-142.htm
support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5047180.html

More vulnerabilities in kerberos

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free