cpe:/a:mit:kerberos:5 cpe:/a:mit:kerberos:5-1.5 cpe:/a:mit:kerberos:5-1.5.1 cpe:/a:mit:kerberos:5-1.5.2 cpe:/a:mit:kerberos:5-1.5.3 cpe:/a:mit:kerberos:5-1.6 cpe:/a:mit:kerberos:5-1.6.1 cpe:/a:mit:kerberos:5-1.6.2 cpe:/a:mit:kerberos:5-1.6.3 CVE-2009-0844 2009-04-08T20:30:00.250-04:00 2017-09-28T21:34:04.123-04:00 5.8 NETWORK MEDIUM NONE PARTIAL NONE PARTIAL http://nvd.nist.gov 2009-04-09T08:15:00.000-04:00 SECTRACK 1021867 BUGTRAQ 20090407 MITKRB5-SA-2009-001: multiple vulnerabilities in SPNEGO, ASN.1 decoder [CVE-2009-0844 CVE-2009-0845 CVE-2009-0847] BUGTRAQ 20090407 rPSA-2009-0058-1 krb5 krb5-server krb5-services krb5-test krb5-workstation SUNALERT 256728 BID 34408 SECUNIA 34594 SECUNIA 34617 SECUNIA 34622 SECUNIA 34628 SECUNIA 34630 SECUNIA 34637 SECUNIA 34640 SECUNIA 34734 SECUNIA 35074 VUPEN ADV-2009-0960 VUPEN ADV-2009-0976 VUPEN ADV-2009-1057 VUPEN ADV-2009-1106 VUPEN ADV-2009-1297 VUPEN ADV-2009-2248 APPLE APPLE-SA-2009-05-12 FEDORA FEDORA-2009-2834 FEDORA FEDORA-2009-2852 GENTOO GLSA-200904-09 MANDRIVA MDVSA-2009:098 REDHAT RHSA-2009:0408 CERT TA09-133A UBUNTU USN-755-1 CERT-VN VU#662091 CONFIRM http://support.apple.com/kb/HT3549 CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2009-142.htm MISC http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5047180.html MISC http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5047181.html CONFIRM http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2009-001.txt CONFIRM http://wiki.rpath.com/Advisories:rPSA-2009-0058 MISC http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0058 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21396120 The get_input_token function in the SPNEGO implementation in MIT Kerberos 5 (aka krb5) 1.5 through 1.6.3 allows remote attackers to cause a denial of service (daemon crash) and possibly obtain sensitive information via a crafted length value that triggers a buffer over-read.