Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
GSS-NTLMSSP vulnerable to incorrect free when decoding target information
Vulnerability Description
GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, an incorrect free when decoding target information can trigger a denial of service. The error condition incorrectly assumes the `cb` and `sh` buffers contain a copy of the data that needs to be freed. However, that is not the case. This vulnerability can be triggered via the main `gss_accept_sec_context` entry point. This will likely trigger an assertion failure in `free`, causing a denial-of-service. This issue is fixed in version 1.2.0.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability Type
释放并不在堆上的内存
Vulnerability Title
GSS-NTLMSSP 安全漏洞
Vulnerability Description
GSS-NTLMSSP是gssapi开源的一个实现 NTLM 身份验证的 GSSAPI 库的 mechglue 插件。 GSS-NTLMSSP 1.2.0之前版本存在安全漏洞，该漏洞源于解码目标信息时错误的释放会触发拒绝服务，攻击者可以通过“gss_accept_sec_context”主入口点触发该漏洞。
CVSS Information
N/A
Vulnerability Type
N/A