CVE-2004-0112: 4d Webstar

Medium severity, CVSS 5.0. EPSS: 10.4% chance of exploitation in the next 30 days.

The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that causes an out-of-bounds read.

Affected products

  • 4d Webstar: version 4.0 only; version 5.2 only; version 5.2.1 only; version 5.2.2 only; version 5.2.3 only; version 5.2.4 only; …
  • Apple Mac OS X: version 10.3.3 only
  • Apple Mac OS X Server: version 10.3.3 only
  • Avaya Converged Communications Server: version 2.0 only
  • Avaya Intuity Audix: any version; version 5.1.46 only; version s3210 only; version s3400 only
  • Avaya s8300: version r2.0.0 only; version r2.0.1 only
  • Avaya s8500: version r2.0.0 only; version r2.0.1 only
  • Avaya s8700: version r2.0.0 only; version r2.0.1 only
  • Avaya SG200: version 4.4 only; version 4.31.29 only
  • Avaya SG203: version 4.4 only; version 4.31.29 only
  • Avaya SG208: any version; version 4.4 only
  • Avaya SG5: version 4.2 only; version 4.3 only; version 4.4 only
  • Avaya Vsu: version 5 only; version 5x only; version 100_r2.0.1 only; version 500 only; version 2000_r2.0.1 only; version 5000_r2.0.1 only; …
  • Bluecoat Cacheos Ca Sa: version 4.1.10 only; version 4.1.12 only
  • Bluecoat Proxysg: any version
  • Check Point Firewall-1: any version; version 2.0 only; version next_generation_fp0 only; version next_generation_fp1 only; version next_generation_fp2 only
  • Check Point Provider-1: version 4.1 only
  • Check Point VPN-1: version next_generation_fp0 only; version next_generation_fp1 only; version next_generation_fp2 only; version vsx_ng_with_application_intelligence only
  • Cisco Access Registrar: any version
  • Cisco Application And Content Networking Software: any version
  • Cisco Call Manager: any version
  • Cisco Ciscoworks Common Management Foundation: version 2.1 only
  • Cisco Ciscoworks Common Services: version 2.2 only
  • Cisco Content Services Switch 11500: any version
  • Cisco CSS11000 Content Services Switch: any version
  • and 40 more

Published 2004-11-23. Last modified 2026-06-16.