Vulnerability in Openafs
CVE-2007-6599
Race condition in fileserver in OpenAFS 1.3.50 through 1.4.5 and 1.5.0 through 1.5.27 allows remote attackers to cause a denial of service (daemon crash) by simultaneously acquiring and giving back file callbacks, which causes the handler for the GiveUpAllCallBacks RPC to perform linked-list operations without the host_glock lock.
Vulnerability class: Race Condition
Published · last modified .
CVSS v2 metric
CVSS v2 base score 4.3 (Medium). Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.017 (75.7th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 76th percentile — 75.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.017 · newest: 0.017 · change: 0.000
Affected products
- Openafs
- Debian Linux — versions 3.1, 4.0
Weakness classification (CWE)
References
- www.securityfocus.com/bid/27132 (VDB Entry, Third Party Advisory, vdb-entry)
- www.novell.com/linux/security/advisories/suse_security_summary_report.html (vendor-advisory, Third Party Advisory)
- lists.openafs.org/pipermail/openafs-announce/2007/000220.html (Vendor Advisory, mailing-list)
- secunia.com/advisories/28401 (Third Party Advisory, third-party-advisory)
- secunia.com/advisories/28327 (Third Party Advisory, third-party-advisory)
- www.openafs.org/security/OPENAFS-SA-2007-003.txt (Vendor Advisory)
- security.gentoo.org/glsa/glsa-200801-04.xml (vendor-advisory, Third Party Advisory)
- secunia.com/advisories/28433 (Third Party Advisory, third-party-advisory)
- www.debian.org/security/2008/dsa-1458 (vendor-advisory, Third Party Advisory)
- www.mandriva.com/security/advisories (vendor-advisory, Third Party Advisory)