CVE-2018-16949
Debian Security Advisory 4302-1
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. Several data types used as RPC input variables were implemented as unbounded array types, limited only by the inherent 32-bit length field to 4 GB. An unauthenticated attacker could send, or claim to send, large input values and consume server resources waiting for those inputs, denying service to other valid connections.
Se ha descubierto un problema en OpenAFS, en versiones anteriores a la 1.6.23 y versiones 1.8.x anteriores a la 1.8.2. Se implementaron varios tipos de datos empleados como variables de entrada RPC como tipos de array sin limitar, limitados solo por el campo length de 32 bits a 4 GB. Un atacante no autenticado podría enviar o decir que envía valores de entrada grandes y consumir recursos del servidor mientras esperan por esas entradas, denegando el servicio a otras conexiones válidas.
Several vulnerabilities were discovered in openafs, an implementation of the distributed filesystem AFS.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2018-09-11 CVE Reserved
- 2018-09-12 CVE Published
- 2024-08-05 CVE Updated
- 2025-04-23 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-400: Uncontrolled Resource Consumption
CAPEC
References (4)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/106375 | Third Party Advisory | |
| https://lists.debian.org/debian-lts-announce/2018/09/msg00024.html | Mailing List |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://openafs.org/pages/security/OPENAFS-SA-2018-003.txt | 2019-03-07 | |
| https://www.debian.org/security/2018/dsa-4302 | 2019-03-07 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Openafs Search vendor "Openafs" | Openafs Search vendor "Openafs" for product "Openafs" | < 1.6.23 Search vendor "Openafs" for product "Openafs" and version " < 1.6.23" | - |
Affected
| ||||||
| Openafs Search vendor "Openafs" | Openafs Search vendor "Openafs" for product "Openafs" | >= 1.8.0 < 1.8.2 Search vendor "Openafs" for product "Openafs" and version " >= 1.8.0 < 1.8.2" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 8.0 Search vendor "Debian" for product "Debian Linux" and version "8.0" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0" | - |
Affected
| ||||||