Published: 12/09/2018 Updated: 07/03/2019

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

An issue exists in OpenAFS prior to 1.6.23 and 1.8.x prior to 1.8.2. Several data types used as RPC input variables were implemented as unbounded array types, limited only by the inherent 32-bit length field to 4 GB. An unauthenticated attacker could send, or claim to send, large input values and consume server resources waiting for those inputs, denying service to other valid connections.

Vulnerable Product	Search on Vulmon	Subscribe to Product
openafs openafs
debian debian linux 8.0
debian debian linux 9.0

Debian Bug report logs - #908616 OpenAFS security release Package: src:openafs; Maintainer for src:openafs is Benjamin Kaduk <kaduk@mitedu>; Reported by: Benjamin Kaduk <kaduk@mitedu> Date: Tue, 11 Sep 2018 19:39:01 UTC Severity: serious Tags: security Found in versions openafs/169-1, openafs/169-2+deb8u7 Fixe ...

Several vulnerabilities were discovered in openafs, an implementation of the distributed filesystem AFS The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2018-16947 Jeffrey Altman reported that the backup tape controller (butc) process does accept incoming RPCs but does not require (or allow for) ...

CWE-400 http://openafs.org/pages/security/OPENAFS-SA-2018-003.txt https://lists.debian.org/debian-lts-announce/2018/09/msg00024.html https://www.debian.org/security/2018/dsa-4302 http://www.securityfocus.com/bid/106375 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=908616 https://nvd.nist.gov https://www.debian.org/security/./dsa-4302

CVE-2018-16949

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect