CVE-2016-2860
CVE-2016-2860
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The newEntry function in ptserver/ptprocs.c in OpenAFS before 1.6.17 allows remote authenticated users from foreign Kerberos realms to bypass intended access restrictions and create arbitrary groups as administrators by leveraging mishandling of the creator ID.
CVSS 6.5 · Medium · EPSS 1.5% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
openafs Debian:12
- Affected ranges
- ECOSYSTEM: < 1.6.17-1
Update to 1.6.17-1
openafs Debian:13
- Affected ranges
- ECOSYSTEM: < 1.6.17-1
Update to 1.6.17-1
openafs Ubuntu:16.04:LTS
- Versions
- 1.6.14-1
- 1.6.15-1
- 1.6.15-1ubuntu1
- 1.6.15-1ubuntu1.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- http://www.openafs.org/pages/security/OPENAFS-SA-2016-001.txt
- http://www.debian.org/security/2016/dsa-3569
- https://www.openafs.org/dl/openafs/1.6.17/RELNOTES-1.6.17
- http://git.openafs.org/?p=openafs.git%3Ba=commitdiff%3Bh=396240cf070a806b91fea81131d034e1399af1e0
- https://lists.openafs.org/pipermail/openafs-announce/2016/000496.html
- https://nvd.nist.gov/vuln/detail/CVE-2016-2860