CVE-2018-16949

HIGH

OpenAFS < 1.6.23 and 1.8.x < 1.8.2 - Unauthenticated Denial of Service via Unbounded RPC Input

Title source: llm

Description

An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. Several data types used as RPC input variables were implemented as unbounded array types, limited only by the inherent 32-bit length field to 4 GB. An unauthenticated attacker could send, or claim to send, large input values and consume server resources waiting for those inputs, denying service to other valid connections.

References (4)

Core 4

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/106375

Mailing List, Third Party Advisory mailing-list x_refsource_mlist

https://lists.debian.org/debian-lts-announce/2018/09/msg00024.html

Vendor Advisory x_refsource_confirm

http://openafs.org/pages/security/OPENAFS-SA-2018-003.txt

Third Party Advisory vendor-advisory x_refsource_debian

https://www.debian.org/security/2018/dsa-4302

Scores

CVSS v3 7.5

EPSS 0.0307

EPSS Percentile 86.0%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE

CWE-400

Status published

Products (3)

debian/debian_linux 8.0

debian/debian_linux 9.0

openafs/openafs < 1.6.23

Published Sep 12, 2018

Tracked Since Feb 18, 2026