CVE-2023-25563 (gss-ntlmssp)

GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, multiple out-of-bounds reads when decoding NTLM fields can trigger a denial of service. A 32-bit integer overflow condition can lead to incorrect checks of consistency of length of internal buffers. Although most applications will error out before accepting a singe input buffer of 4GB in length this could theoretically happen. This vulnerability can be triggered via the main `gss_accept_sec_context` entry point if the …

applications authentication buffer cve decoding denial of service entry error input integer internal length library main ntlm ntlm authentication ntlmssp out-of-bounds overflow plugin point service trigger version version 1 vulnerability