Buffer overflow in Openafs

CVE-2014-0159

Buffer overflow in the GetStatistics64 remote procedure call (RPC) in OpenAFS 1.4.8 before 1.6.7 allows remote attackers to cause a denial of service (crash) via a crafted statsVersion argument.

Vulnerability class: Buffer Overflow

EPSS: 0.022 (80.5th percentile) — read the EPSS interpretation.

Affected products

Openafs — versions 1.4.8, 1.4.9, 1.4.10
Debian Debian_linux — versions 7.0
N/a — versions n/a

Weakness classification (CWE)

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

References

secalert@redhat.com (x_refsource_CONFIRM, Vendor Advisory)
secalert@redhat.com (x_refsource_CONFIRM, Release Notes, Issue Tracking)
secalert@redhat.com (Permissions Required, x_refsource_SECUNIA, Third Party Advisory, third-party-advisory)
secalert@redhat.com (vendor-advisory, x_refsource_MANDRIVA, Broken Link)
secalert@redhat.com (Permissions Required, x_refsource_SECUNIA, Third Party Advisory, third-party-advisory)
secalert@redhat.com (vendor-advisory, Third Party Advisory, x_refsource_DEBIAN)