CVE-2009-1250
The cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58, and IBM AFS 3.6 before Patch 19, on Linux allows remote attackers to cause a denial of service (system crash) via an RX response with a large error-code value that is…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (3.98%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58, and IBM AFS 3.6 before Patch 19, on Linux allows remote attackers to cause a denial of service (system crash) via an RX response with a large error-code value that is interpreted as a pointer and dereferenced, related to use of the ERR_PTR macro.
- CVSS 2.0
- 7.8 HIGHAV:N/AC:L/Au:N/C:N/I:N/A:C
- EPSS
- 3.98% probability · 90th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-189
- Affected
- ibm/afs · openafs/openafs
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/34655
- http://secunia.com/advisories/34684
- http://secunia.com/advisories/36310
- http://secunia.com/advisories/42896
- http://security.gentoo.org/glsa/glsa-201101-05.xml
- http://www-01.ibm.com/support/docview.wss?uid=swg21396389
- http://www-1.ibm.com/support/docview.wss?uid=swg1ID71123
- http://www.debian.org/security/2009/dsa-1768
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:099
- http://www.openafs.org/security/OPENAFS-SA-2009-002.txt
- http://www.openafs.org/security/openafs-sa-2009-002.patchExploit
- http://www.securityfocus.com/bid/34404
- http://www.vupen.com/english/advisories/2009/0984
- http://www.vupen.com/english/advisories/2011/0117
- http://secunia.com/advisories/34655
- http://secunia.com/advisories/34684
- http://secunia.com/advisories/36310
- http://secunia.com/advisories/42896
- http://security.gentoo.org/glsa/glsa-201101-05.xml
- http://www-01.ibm.com/support/docview.wss?uid=swg21396389
- http://www-1.ibm.com/support/docview.wss?uid=swg1ID71123
- http://www.debian.org/security/2009/dsa-1768
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:099
- http://www.openafs.org/security/OPENAFS-SA-2009-002.txt
- http://www.openafs.org/security/openafs-sa-2009-002.patchExploit
- http://www.securityfocus.com/bid/34404
- http://www.vupen.com/english/advisories/2009/0984
- http://www.vupen.com/english/advisories/2011/0117
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.