CVE-2010-0433 Null dereference in n/a
Remote attackers can cause a denial of service via SSL cipher negotiation in OpenSSL when Kerberos is enabled but configuration files are missing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2010-0433?
CVE-2010-0433 is a medium-severity vulnerability in Openssl Openssl, published on 5 Mar 2010. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The kssl_keytab_is_available function in ssl/kssl.c in OpenSSL before 0.9.8n, when Kerberos is enabled but Kerberos configuration files cannot be opened, does not check a certain return value, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via SSL cipher negotiation, as demonstrated by a chroot installation of Dovecot or stunnel without Kerberos configuration files inside the chroot.
Weakness: CWE-20
Which versions are affected by CVE-2010-0433?
It affects 1 product.
Products include Openssl Openssl.
How do I fix CVE-2010-0433?
Upgrade to a fixed version.
Is CVE-2010-0433 being exploited?
There is no known exploitation of CVE-2010-0433 in the wild and no public exploit code.
Other vulnerabilities in Openssl Openssl
Sources
Also known as GHSA-5gv7-x3p9-2mf6.