Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

OpenSSL may crash during SSL handshake when Kerberos missing

CVE-2010-0433 · published 16 years ago
Summary

Versions of OpenSSL earlier than 0.9.8n can fail to check a missing return value when Kerberos is turned on but its configuration files are not reachable. This can cause the server process handling SSL connections to crash, leading to a denial of service. Update OpenSSL to a newer release or disable Kerberos support to prevent the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
openssl openssl <= 0.9.8m
0.9.8
0.9.8a
0.9.8b
0.9.8c
0.9.8d
0.9.8e
0.9.8f
0.9.8g
0.9.8h
0.9.8i
0.9.8j
2 more version ranges
cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
Original advisory text
The kssl_keytab_is_available function in ssl/kssl.c in OpenSSL before 0.9.8n, when Kerberos is enabled but Kerberos configuration files cannot be opened, does not check a certain return value, whic...
The kssl_keytab_is_available function in ssl/kssl.c in OpenSSL before 0.9.8n, when Kerberos is enabled but Kerberos configuration files cannot be opened, does not check a certain return value, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via SSL cipher negotiation, as demonstrated by a chroot installation of Dovecot or stunnel without Kerberos configuration files inside the chroot.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
4.3 Medium
Exploitation
8% chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published5 Mar 2010
Updated15 Oct 2026
First seen29 Sep 2026
Sources
CVE-2010-0433 · NVD
Track software like this
Free during beta