CVE-2007-1507
published 2007-03-20CVE-2007-1507: The default configuration in OpenAFS 1.4.x before 1.4.4 and 1.5.x before 1.5.17 supports setuid programs within the local cell, which might allow attackers to…
PriorityP336high7.5CVSS 2.0
AVNACLAuNCPIPAP
EPSS
2.52%
83.0th percentile
The default configuration in OpenAFS 1.4.x before 1.4.4 and 1.5.x before 1.5.17 supports setuid programs within the local cell, which might allow attackers to gain privileges by spoofing a response to an AFS cache manager FetchStatus request, and setting setuid and root ownership for files in the cache.
Affected
25 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | openafs | < openafs 1.4.2-6 (bookworm) | openafs 1.4.2-6 (bookworm) |
| openafs | openafs | — | — |
| openafs | openafs | — | — |
| openafs | openafs | — | — |
| openafs | openafs | — | — |
| openafs | openafs | — | — |
| openafs | openafs | — | — |
| openafs | openafs | — | — |
| openafs | openafs | — | — |
| openafs | openafs | — | — |
| openafs | openafs | — | — |
| openafs | openafs | — | — |
| openafs | openafs | — | — |
| openafs | openafs | — | — |
| openafs | openafs | — | — |
| openafs | openafs | — | — |
| openafs | openafs | — | — |
| openafs | openafs | — | — |
| openafs | openafs | — | — |
| openafs | openafs | — | — |
| openafs | openafs | — | — |
| openafs | openafs | — | — |
| openafs | openafs | >= 0 < 1.4.2-6 | 1.4.2-6 |
| openafs | openafs | >= 0 < 1.4.2-6 | 1.4.2-6 |
| openafs | openafs | >= 0 < 1.4.2-6 | 1.4.2-6 |
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv7.5HIGH
vendor_debian7.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-52gf-7jph-c2gx: The default configuration in OpenAFS 1
ghsa_unreviewed·2022-05-01
CVE-2007-1507 [HIGH] GHSA-52gf-7jph-c2gx: The default configuration in OpenAFS 1
The default configuration in OpenAFS 1.4.x before 1.4.4 and 1.5.x before 1.5.17 supports setuid programs within the local cell, which might allow attackers to gain privileges by spoofing a response to an AFS cache manager FetchStatus request, and setting setuid and root ownership for files in the cache.
OSV
CVE-2007-1507: The default configuration in OpenAFS 1
osv·2007-03-20·CVSS 7.5
CVE-2007-1507 [HIGH] CVE-2007-1507: The default configuration in OpenAFS 1
The default configuration in OpenAFS 1.4.x before 1.4.4 and 1.5.x before 1.5.17 supports setuid programs within the local cell, which might allow attackers to gain privileges by spoofing a response to an AFS cache manager FetchStatus request, and setting setuid and root ownership for files in the cache.
Debian
CVE-2007-1507: openafs - The default configuration in OpenAFS 1.4.x before 1.4.4 and 1.5.x before 1.5.17 ...
vendor_debian·2007·CVSS 7.5
CVE-2007-1507 [HIGH] CVE-2007-1507: openafs - The default configuration in OpenAFS 1.4.x before 1.4.4 and 1.5.x before 1.5.17 ...
The default configuration in OpenAFS 1.4.x before 1.4.4 and 1.5.x before 1.5.17 supports setuid programs within the local cell, which might allow attackers to gain privileges by spoofing a response to an AFS cache manager FetchStatus request, and setting setuid and root ownership for files in the cache.
Scope: local
bookworm: resolved (fixed in 1.4.2-6)
bullseye: resolved (fixed in 1.4.2-6)
sid: resolved (fixed in 1.4.2-6)
trixie: resolved (fixed in 1.4.2-6)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://secunia.com/advisories/24582http://secunia.com/advisories/24599http://secunia.com/advisories/24607http://secunia.com/advisories/24720http://security.gentoo.org/glsa/glsa-200704-03.xmlhttp://www.debian.org/security/2007/dsa-1271http://www.mandriva.com/security/advisories?name=MDKSA-2007:066http://www.openafs.org/pipermail/openafs-announce/2007/000185.htmlhttp://www.openafs.org/pipermail/openafs-announce/2007/000186.htmlhttp://www.openafs.org/pipermail/openafs-announce/2007/000187.htmlhttp://www.securityfocus.com/bid/23060http://www.securitytracker.com/id?1017807http://www.vupen.com/english/advisories/2007/1033https://exchange.xforce.ibmcloud.com/vulnerabilities/33180http://secunia.com/advisories/24582http://secunia.com/advisories/24599http://secunia.com/advisories/24607http://secunia.com/advisories/24720http://security.gentoo.org/glsa/glsa-200704-03.xmlhttp://www.debian.org/security/2007/dsa-1271http://www.mandriva.com/security/advisories?name=MDKSA-2007:066http://www.openafs.org/pipermail/openafs-announce/2007/000185.htmlhttp://www.openafs.org/pipermail/openafs-announce/2007/000186.htmlhttp://www.openafs.org/pipermail/openafs-announce/2007/000187.htmlhttp://www.securityfocus.com/bid/23060http://www.securitytracker.com/id?1017807http://www.vupen.com/english/advisories/2007/1033https://exchange.xforce.ibmcloud.com/vulnerabilities/33180
2007-03-20
Published