CVE-2004-0112
The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos...
CVE-2004-0112 is a medium vulnerability (CVSS 5.0) in Openssl, published March 18, 2004. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 10.4%, the 95th percentile. Fixed in openssl 0.9.7d-1.
The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that causes an out-of-bounds read.
Exploit likelihood
What each source reports
NVD Score used
The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that causes an out-of-bounds read.
- Record
CVE-2004-0112- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List No score
The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that causes an out-of-bounds read.
- Record
CVE-2004-0112- Updated
- 2026-11-02
EUVDEUVD-2004-0112 No score
The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that causes an out-of-bounds read.
- Record
EUVD-2004-0112- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-ph6p-3j2f-xq2g No score
The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos...
The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that causes an out-of-bounds read.
- Record
GHSA-ph6p-3j2f-xq2g- Updated
- 2026-11-02
OSV No score
The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that causes an out-of-bounds read.
- Record
CVE-2004-0112- Updated
- 2026-11-02
OSVDEBIAN-CVE-2004-0112 No score
The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that causes an out-of-bounds read.
- Record
DEBIAN-CVE-2004-0112- Updated
- 2026-11-02
Affected products
- openssl
- redhat openssl
- redhat enterprise linux
- redhat enterprise linux desktop
- redhat linux
- 4d webstar
- apple mac os x
- apple mac os x server
- avaya converged communications server
- avaya intuity audix
- avaya s8300
- avaya s8500
Show 53 moreShow less
- avaya s8700
- avaya sg200
- avaya sg203
- avaya sg208
- avaya sg5
- avaya vsu
- bluecoat cacheos ca sa
- bluecoat proxysg
- checkpoint firewall-1
- checkpoint provider-1
- checkpoint vpn-1
- cisco access registrar
- cisco application and content networking software
- cisco call manager
- cisco ciscoworks common management foundation
- cisco ciscoworks common services
- cisco content services switch 11500
- cisco css11000 content services switch
- cisco css secure content accelerator
- cisco firewall services module
- cisco gss 4480 global site selector
- cisco gss 4490 global site selector
- cisco ios
- cisco mds 9000
- cisco okena stormwatch
- cisco pix firewall
- cisco pix firewall software
- cisco secure content accelerator
- cisco threat response
- cisco webns
- dell bsafe ssl-j
- forcepoint stonegate
- freebsd
- hp aaa server
- hp apache-based web server
- hp hp-ux
- hp wbem
- litespeedtech litespeed web server
- neoteris instant virtual extranet
- novell edirectory
- novell imanager
- openbsd
- sco openserver
- securecomputing sidewinder
- sgi propack
- stonesoft servercluster
- stonesoft stonebeat fullcluster
- stonesoft stonebeat securitycluster
- stonesoft stonebeat webcluster
- sun crypto accelerator 4000
- symantec clientless vpn gateway 4400
- tarantella enterprise
- vmware gsx server
Affected packages
| Package | Affected | Fixed |
|---|---|---|
opensslDebian:12 |
before 0.9.7d-1 | 0.9.7d-1 |
opensslDebian:13 |
before 0.9.7d-1 | 0.9.7d-1 |
opensslDebian:14 |
before 0.9.7d-1 | 0.9.7d-1 |
opensslRed Hat:enterprise_linux:3::as |
before 0:0.9.7a-33.4 | 0:0.9.7a-33.4 |
openssl-debuginfoRed Hat:enterprise_linux:3::as |
before 0:0.9.7a-33.4 | 0:0.9.7a-33.4 |
openssl-develRed Hat:enterprise_linux:3::as |
before 0:0.9.7a-33.4 | 0:0.9.7a-33.4 |
openssl-perlRed Hat:enterprise_linux:3::as |
before 0:0.9.7a-33.4 | 0:0.9.7a-33.4 |
openssl096bRed Hat:enterprise_linux:3::as |
before 0:0.9.6b-16 | 0:0.9.6b-16 |
openssl096b-debuginfoRed Hat:enterprise_linux:3::as |
before 0:0.9.6b-16 | 0:0.9.6b-16 |
opensslRed Hat:enterprise_linux:3::desktop |
before 0:0.9.7a-33.4 | 0:0.9.7a-33.4 |
Show 17 moreShow less
| Package | Affected | Fixed |
|---|---|---|
openssl-debuginfoRed Hat:enterprise_linux:3::desktop |
before 0:0.9.7a-33.4 | 0:0.9.7a-33.4 |
openssl-develRed Hat:enterprise_linux:3::desktop |
before 0:0.9.7a-33.4 | 0:0.9.7a-33.4 |
openssl-perlRed Hat:enterprise_linux:3::desktop |
before 0:0.9.7a-33.4 | 0:0.9.7a-33.4 |
openssl096bRed Hat:enterprise_linux:3::desktop |
before 0:0.9.6b-16 | 0:0.9.6b-16 |
openssl096b-debuginfoRed Hat:enterprise_linux:3::desktop |
before 0:0.9.6b-16 | 0:0.9.6b-16 |
opensslRed Hat:enterprise_linux:3::es |
before 0:0.9.7a-33.4 | 0:0.9.7a-33.4 |
openssl-debuginfoRed Hat:enterprise_linux:3::es |
before 0:0.9.7a-33.4 | 0:0.9.7a-33.4 |
openssl-develRed Hat:enterprise_linux:3::es |
before 0:0.9.7a-33.4 | 0:0.9.7a-33.4 |
openssl-perlRed Hat:enterprise_linux:3::es |
before 0:0.9.7a-33.4 | 0:0.9.7a-33.4 |
openssl096bRed Hat:enterprise_linux:3::es |
before 0:0.9.6b-16 | 0:0.9.6b-16 |
openssl096b-debuginfoRed Hat:enterprise_linux:3::es |
before 0:0.9.6b-16 | 0:0.9.6b-16 |
opensslRed Hat:enterprise_linux:3::ws |
before 0:0.9.7a-33.4 | 0:0.9.7a-33.4 |
openssl-debuginfoRed Hat:enterprise_linux:3::ws |
before 0:0.9.7a-33.4 | 0:0.9.7a-33.4 |
openssl-develRed Hat:enterprise_linux:3::ws |
before 0:0.9.7a-33.4 | 0:0.9.7a-33.4 |
openssl-perlRed Hat:enterprise_linux:3::ws |
before 0:0.9.7a-33.4 | 0:0.9.7a-33.4 |
openssl096bRed Hat:enterprise_linux:3::ws |
before 0:0.9.6b-16 | 0:0.9.6b-16 |
openssl096b-debuginfoRed Hat:enterprise_linux:3::ws |
before 0:0.9.6b-16 | 0:0.9.6b-16 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
securityfocus.com/bid/9899
marc.info?l=bugtraq&m=108403806509920&w=2
redhat.com/support/errata/RHSA-2004-121.html
mandriva.com/security/advisories?name=MDKSA-2004:023
distro.conectiva.com.br/atualizacoes?id=a&anuncio=000834
uniras.gov.uk/vuls/2004/224012/index.htm
Show 41 moreShow less
sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/57524
novell.com/linux/security/advisories/2004_07_openssl.html
lists.apple.com/mhonarc/security-announce/msg00045.html
openssl.org/news/secadv_20040317.txt
ciac.org/ciac/bulletins/o-101.shtml
us-cert.gov/cas/techalerts/TA04-078A.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1049
exchange.xforce.ibmcloud.com/vulnerabilities/15508
kb.cert.org/vuls/id/484726
security.gentoo.org/glsa/glsa-200403-03.xml
secunia.com/advisories/11139
slackware.org/security/viewer.php?l=slackware-security&y=2004&m=slackware-security.455961
trustix.org/errata/2004/0012
cisco.com/warp/public/707/cisco-sa-20040317-openssl.shtml
docs.info.apple.com/article.html?artnum=61798
nvd.nist.gov/vuln/detail/CVE-2004-0112
github.com/advisories/GHSA-ph6p-3j2f-xq2g
security-tracker.debian.org/tracker/CVE-2004-0112
access.redhat.com/errata/RHSA-2004:120
codenomicon.com/testtools/tls
niscc.gov.uk
bugzilla.redhat.com/show_bug.cgi?id=117770
security.access.redhat.com/data/csaf/v2/advisories/2004/rhsa-2004_120.json
cve.org/CVERecord?id=CVE-2004-0079