CVE-2023-25567

Name of the Vulnerable Software and Affected Versions GSS-NTLMSSP versions prior to 1.2.0

Description The issue is an out-of-bounds read that occurs when decoding target information. This happens because the length of the av pair is not properly checked for two elements, which can trigger an out-of-bounds read. The out-of-bounds read can be triggered via the main gss accept sec context entry point and could cause a denial-of-service if the memory is unmapped.

Recommendations For versions prior to 1.2.0, update to version 1.2.0 to resolve the issue. As a temporary workaround, consider restricting access to the gss accept sec context entry point to minimize the risk of exploitation.