CVE-2010-0433
Detail
Deferred
This CVE record is not being prioritized for NVD enrichment efforts due to resource or other concerns.
Description
The kssl_keytab_is_available function in ssl/kssl.c in OpenSSL before 0.9.8n, when Kerberos is enabled but Kerberos configuration files cannot be opened, does not check a certain return value, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via SSL cipher negotiation, as demonstrated by a chroot installation of Dovecot or stunnel without Kerberos configuration files inside the chroot.
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 4.0 Severity and Vector Strings:
NVD assessment
not yet provided.
CVSS 3.x Severity and Vector Strings:
NVD assessment
not yet provided.
CVSS 2.0 Severity and Vector Strings:
Vector:
(AV:N/AC:M/Au:N/C:N/I:N/A:P)
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [email protected] .
URL
Source(s)
Tag(s)
http://aix.software.ibm.com/aix/efixes/security/openssl_advisory.asc
CVE, Inc., Red Hat
http://cvs.openssl.org/chngview?cn=19374
CVE, Inc., Red Hat
http://groups.google.com/group/mailing.openssl.users/browse_thread/thread/c3e1ab0034ca4b4c/66aa896c3a78b2f7
CVE, Inc., Red Hat
http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038587.html
CVE, Inc., Red Hat
http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039561.html
CVE, Inc., Red Hat
http://marc.info/?l=bugtraq&m=127128920008563&w=2
CVE, Inc., Red Hat
http://marc.info/?l=bugtraq&m=127557640302499&w=2
CVE, Inc., Red Hat
http://secunia.com/advisories/39461
CVE, Inc., Red Hat
http://secunia.com/advisories/39932
CVE, Inc., Red Hat
http://secunia.com/advisories/42724
CVE, Inc., Red Hat
http://secunia.com/advisories/42733
CVE, Inc., Red Hat
http://secunia.com/advisories/43311
CVE, Inc., Red Hat
http://www.mail-archive.com/dovecot%40dovecot.org/msg26224.html
CVE, Inc., Red Hat
http://www.mandriva.com/security/advisories?name=MDVSA-2010:076
CVE, Inc., Red Hat
http://www.openssl.org/news/changelog.html
CVE, Inc., Red Hat
http://www.openwall.com/lists/oss-security/2010/03/03/5
CVE, Inc., Red Hat
http://www.securityfocus.com/archive/1/516397/100/0/threaded
CVE, Inc., Red Hat
http://www.vmware.com/security/advisories/VMSA-2011-0003.html
CVE, Inc., Red Hat
http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html
CVE, Inc., Red Hat
http://www.vupen.com/english/advisories/2010/0839
CVE, Inc., Red Hat
http://www.vupen.com/english/advisories/2010/0916
CVE, Inc., Red Hat
http://www.vupen.com/english/advisories/2010/0933
CVE, Inc., Red Hat
http://www.vupen.com/english/advisories/2010/1216
CVE, Inc., Red Hat
https://bugzilla.redhat.com/show_bug.cgi?id=567711
CVE, Inc., Red Hat
https://bugzilla.redhat.com/show_bug.cgi?id=569774
CVE, Inc., Red Hat
https://kb.bluecoat.com/index?page=content&id=SA50
CVE, Inc., Red Hat
https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000101.html
CVE, Inc., Red Hat
https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000102.html
CVE, Inc., Red Hat
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12260
CVE, Inc., Red Hat
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6718
CVE, Inc., Red Hat
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9856
CVE, Inc., Red Hat
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-20
Improper Input Validation
NIST
Change History
7 change records found show changes
CVE Modified by CVE 11/20/2024 8:12:12 PM
Action
Type
Old Value
New Value
Added
Reference
http://aix.software.ibm.com/aix/efixes/security/openssl_advisory.asc
Added
Reference
http://cvs.openssl.org/chngview?cn=19374
Added
Reference
http://groups.google.com/group/mailing.openssl.users/browse_thread/thread/c3e1ab0034ca4b4c/66aa896c3a78b2f7
Added
Reference
http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038587.html
Added
Reference
http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039561.html
Added
Reference
http://marc.info/?l=bugtraq&m=127128920008563&w=2
Added
Reference
http://marc.info/?l=bugtraq&m=127128920008563&w=2
Added
Reference
http://marc.info/?l=bugtraq&m=127557640302499&w=2
Added
Reference
http://marc.info/?l=bugtraq&m=127557640302499&w=2
Added
Reference
http://secunia.com/advisories/39461
Added
Reference
http://secunia.com/advisories/39932
Added
Reference
http://secunia.com/advisories/42724
Added
Reference
http://secunia.com/advisories/42733
Added
Reference
http://secunia.com/advisories/43311
Added
Reference
http://www.mail-archive.com/dovecot%40dovecot.org/msg26224.html
Added
Reference
http://www.mandriva.com/security/advisories?name=MDVSA-2010:076
Added
Reference
http://www.openssl.org/news/changelog.html
Added
Reference
http://www.openwall.com/lists/oss-security/2010/03/03/5
Added
Reference
http://www.securityfocus.com/archive/1/516397/100/0/threaded
Added
Reference
http://www.vmware.com/security/advisories/VMSA-2011-0003.html
Added
Reference
http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html
Added
Reference
http://www.vupen.com/english/advisories/2010/0839
Added
Reference
http://www.vupen.com/english/advisories/2010/0916
Added
Reference
http://www.vupen.com/english/advisories/2010/0933
Added
Reference
http://www.vupen.com/english/advisories/2010/1216
Added
Reference
https://bugzilla.redhat.com/show_bug.cgi?id=567711
Added
Reference
https://bugzilla.redhat.com/show_bug.cgi?id=569774
Added
Reference
https://kb.bluecoat.com/index?page=content&id=SA50
Added
Reference
https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000101.html
Added
Reference
https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000102.html
Added
Reference
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12260
Added
Reference
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6718
Added
Reference
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9856
CVE Modified by Red Hat, Inc. 5/13/2024 10:15:06 PM
Action
Type
Old Value
New Value
CVE Modified by Red Hat, Inc. 2/12/2023 11:16:29 PM
Action
Type
Old Value
New Value
Added
Reference
http://www.mail-archive.com/dovecot%40dovecot.org/msg26224.html [No Types Assigned]
Removed
Reference
http://www.mail-archive.com/[email protected] /msg26224.html [No Types Assigned]
CVE Modified by Red Hat, Inc. 10/10/2018 3:52:43 PM
Action
Type
Old Value
New Value
Added
Reference
http://www.securityfocus.com/archive/1/516397/100/0/threaded [No Types Assigned]
Removed
Reference
http://www.securityfocus.com/archive/1/archive/1/516397/100/0/threaded [No Types Assigned]
CVE Modified by Red Hat, Inc. 9/18/2017 9:30:23 PM
Action
Type
Old Value
New Value
Added
Reference
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12260 [No Types Assigned]
Added
Reference
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6718 [No Types Assigned]
Added
Reference
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9856 [No Types Assigned]
Removed
Reference
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:12260 [No Types Assigned]
Removed
Reference
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:6718 [No Types Assigned]
Removed
Reference
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9856 [No Types Assigned]
CVE Modified by Red Hat, Inc. 8/22/2016 10:00:41 PM
Action
Type
Old Value
New Value
Added
Reference
http://marc.info/?l=bugtraq&m=127128920008563&w=2
Added
Reference
http://marc.info/?l=bugtraq&m=127557640302499&w=2
Initial CVE Analysis 3/08/2010 9:27:00 AM
Action
Type
Old Value
New Value
Quick Info
CVE Dictionary Entry: CVE-2010-0433 NVD
Published Date: 03/05/2010 NVD
Last Modified: 04/10/2025
Source: Red Hat, Inc.