CVE-2018-16949
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. Several data types used as RPC input variables were implemented as unbounded array types, limited only by the inherent 32-bit length field to 4 GB. An unauthenticated attacker could send, or claim to send, large input values and consume server resources waiting for those inputs, denying service to other valid connections.
Se ha descubierto un problema en OpenAFS, en versiones anteriores a la 1.6.23 y versiones 1.8.x anteriores a la 1.8.2. Se implementaron varios tipos de datos empleados como variables de entrada RPC como tipos de array sin limitar, limitados solo por el campo length de 32 bits a 4 GB. Un atacante no autenticado podría enviar o decir que envía valores de entrada grandes y consumir recursos del servidor mientras esperan por esas entradas, denegando el servicio a otras conexiones válidas.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2018-09-11 CVE Reserved
- 2018-09-12 CVE Published
- 2024-06-27 EPSS Updated
- 2024-08-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-400: Uncontrolled Resource Consumption
CAPEC
References (4)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/106375 | Third Party Advisory | |
| https://lists.debian.org/debian-lts-announce/2018/09/msg00024.html | Mailing List |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://openafs.org/pages/security/OPENAFS-SA-2018-003.txt | 2019-03-07 | |
| https://www.debian.org/security/2018/dsa-4302 | 2019-03-07 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Openafs Search vendor "Openafs" | Openafs Search vendor "Openafs" for product "Openafs" | < 1.6.23 Search vendor "Openafs" for product "Openafs" and version " < 1.6.23" | - |
Affected
| ||||||
| Openafs Search vendor "Openafs" | Openafs Search vendor "Openafs" for product "Openafs" | >= 1.8.0 < 1.8.2 Search vendor "Openafs" for product "Openafs" and version " >= 1.8.0 < 1.8.2" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 8.0 Search vendor "Debian" for product "Debian Linux" and version "8.0" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0" | - |
Affected
| ||||||