Vulnerabilities > Openafs

DATE CVE VULNERABILITY TITLE RISK
2014-04-14 CVE-2014-0159 Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products
Buffer overflow in the GetStatistics64 remote procedure call (RPC) in OpenAFS 1.4.8 before 1.6.7 allows remote attackers to cause a denial of service (crash) via a crafted statsVersion argument.
network
low complexity
openafs debian CWE-119
5.0
2013-11-05 CVE-2013-4135 Cryptographic Issues vulnerability in multiple products
The vos command in OpenAFS 1.6.x before 1.6.5, when using the -encrypt option, only enables integrity protection and sends data in cleartext, which allows remote attackers to obtain sensitive information by sniffing the network.
4.3
2013-11-05 CVE-2013-4134 Cryptographic Issues vulnerability in multiple products
OpenAFS before 1.4.15, 1.6.x before 1.6.5, and 1.7.x before 1.7.26 uses weak encryption (DES) for Kerberos keys, which makes it easier for remote attackers to obtain the service key.
4.3
2013-03-14 CVE-2013-1795 Numeric Errors vulnerability in Openafs
Integer overflow in ptserver in OpenAFS before 1.6.2 allows remote attackers to cause a denial of service (crash) via a large list from the IdToName RPC, which triggers a heap-based buffer overflow.
network
low complexity
openafs CWE-189
5.0
2013-03-14 CVE-2013-1794 Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Openafs
Buffer overflow in certain client utilities in OpenAFS before 1.6.2 allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a long fileserver ACL entry.
network
low complexity
openafs CWE-119
6.5
2011-02-19 CVE-2011-0431 Improper Input Validation vulnerability in Openafs 1.4.12/1.4.14/1.4.7
The afs_linux_lock function in afs/LINUX/osi_vnodeops.c in the kernel module in OpenAFS 1.4.14, 1.4.12, 1.4.7, and possibly other versions does not properly handle errors, which allows attackers to cause a denial of service via unknown vectors.
network
low complexity
openafs CWE-20
5.0
2011-02-19 CVE-2011-0430 Resource Management Errors vulnerability in Openafs 1.4.12/1.4.14/1.4.7
Double free vulnerability in the Rx server process in OpenAFS 1.4.14, 1.4.12, 1.4.7, and possibly other versions allows remote attackers to cause a denial of service and execute arbitrary code via unknown vectors.
network
low complexity
openafs CWE-399
7.5
2009-04-09 CVE-2009-1251 Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products
Heap-based buffer overflow in the cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58 on Unix platforms allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via an RX response containing more data than specified in a request, related to use of XDR arrays.
network
low complexity
unix openafs CWE-119
critical
10.0
2009-04-09 CVE-2009-1250 Numeric Errors vulnerability in multiple products
The cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58, and IBM AFS 3.6 before Patch 19, on Linux allows remote attackers to cause a denial of service (system crash) via an RX response with a large error-code value that is interpreted as a pointer and dereferenced, related to use of the ERR_PTR macro.
network
low complexity
ibm openafs linux CWE-189
7.8
2008-01-04 CVE-2007-6599 Race Condition vulnerability in multiple products
Race condition in fileserver in OpenAFS 1.3.50 through 1.4.5 and 1.5.0 through 1.5.27 allows remote attackers to cause a denial of service (daemon crash) by simultaneously acquiring and giving back file callbacks, which causes the handler for the GiveUpAllCallBacks RPC to perform linked-list operations without the host_glock lock.
4.3