Description
The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that causes an out-of-bounds read.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openssl | 0.9.7d-1 | — |
| Debian 13 | openssl | 0.9.7d-1 | — |
| Debian 12 | openssl | 0.9.7d-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | openssl +2 | 0.9.7a-33.4 | RHSA-2004:120 |
| RHEL 3 | openssl096b | 0.9.6b-16 | RHSA-2004:120 |
Advisories 1
- RHSA-2004:120 Red Hat Security Advisory: openssl security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- 9899 vdb-entry
- SSRT4717 vendor-advisory
- RHSA-2004:121 vendor-advisory
- MDKSA-2004:023 vendor-advisory
- CLA-2004:834 vendor-advisory
- http://www.uniras.gov.uk/vuls/2004/224012/index.htm
- 57524 vendor-advisory
- SuSE-SA:2004:007 vendor-advisory
- http://lists.apple.com/mhonarc/security-announce/msg00045.html
- http://www.openssl.org/news/secadv_20040317.txt
- O-101 third-party-advisory government-resource
- TA04-078A third-party-advisory
- oval:org.mitre.oval:def:1049 vdb-entry signature
- openssl-kerberos-ciphersuites-dos(15508) vdb-entry
- VU#484726 third-party-advisory
- GLSA-200403-03 vendor-advisory
- oval:org.mitre.oval:def:9580 vdb-entry signature
- 11139 third-party-advisory
- RHSA-2004:120 vendor-advisory
- 20040317 New OpenSSL releases fix denial of service attacks [17 March 2004] mailing-list
- APPLE-SA-2005-08-15 vendor-advisory
- SSA:2004-077 vendor-advisory
- 2004-0012 vendor-advisory
- 20040317 Cisco OpenSSL Implementation Vulnerability vendor-advisory
- http://docs.info.apple.com/article.html?artnum=61798
- APPLE-SA-2005-08-17 vendor-advisory
- oval:org.mitre.oval:def:928 vdb-entry signature