Skip to content
Back to search

CVE-2004-0112

MEDIUM
5.0NVD

Summary

generated automatically from NVD data

OpenSSL 0.9.7a, 0.9.7b and 0.9.7c contain a flaw in the SSL/TLS handshake code used with Kerberos ciphersuites: the length of Kerberos tickets is not properly checked. A remote attacker can send a crafted handshake that triggers an out-of-bounds read (CWE-125) and crashes the service, causing a denial of service. NVD also lists products from Cisco, HP, Symantec and Avaya as affected, and rates the flaw 5.0 (MEDIUM, CVSS v2.0).

NVD description

The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that causes an out-of-bounds read.

Share:

EPSS · FIRST.org

10.4%probability of exploitation in the next 30 days

Higher than 95% of scored CVEs

EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-11-01, recomputed daily by FIRST.org.

CVSS v2.0 Score

5.0
/ 10.0
MEDIUM
AV:N/AC:L/Au:N/C:N/I:N/A:P

Information

Published
23 nov. 2004
Updated
16 juin 2026
Status
Modified
Source
cve@mitre.org

Affected products

cisco firewall services module
Versions 1.1.2 · 1.1.3 · 1.1_\(3.005\) · 2.1_\(0.208\)
hp aaa server
hp apache-based web server
Versions 2.0.43.00 · 2.0.43.04
symantec clientless vpn gateway 4400
Versions 5.0
cisco ciscoworks common management foundation
Versions 2.1
cisco ciscoworks common services
Versions 2.2
avaya converged communications server
Versions 2.0
avaya sg200
Versions 4.4 · 4.31.29

Bounds published by NVD: "< 8.4.27" means 8.4.27 is no longer vulnerable. The fixed release to install is in the vendor advisory.

Weaknesses (CWE)

CWE-125

References (58)

Similar CVEs

Other vulnerabilities of type CWE-125

…

Know which CVEs hit the versions you run.

Add the product and its version: cveo.tech lists the CVEs that affect it right away, then alerts you by email when a new one affects it — including before NVD has finished its analysis. Free, an account is all it takes.

Add my first deviceI already have an account