CVE-2009-1250
published 2009-04-09CVE-2009-1250: The cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58, and IBM AFS 3.6 before Patch 19, on Linux allows remote attackers to…
PriorityP432high7.8CVSS 2.0
AVNACLAuNCNINAC
EPSS
3.98%
89.3th percentile
The cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58, and IBM AFS 3.6 before Patch 19, on Linux allows remote attackers to cause a denial of service (system crash) via an RX response with a large error-code value that is interpreted as a pointer and dereferenced, related to use of the ERR_PTR macro.
Affected
77 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | openafs | < openafs 1.4.10+dfsg1-1 (bookworm) | openafs 1.4.10+dfsg1-1 (bookworm) |
| ibm | afs | <= 3.6 | — |
| ibm | afs | — | — |
| openafs | openafs | — | — |
| openafs | openafs | — | — |
| openafs | openafs | — | — |
| openafs | openafs | — | — |
| openafs | openafs | — | — |
| openafs | openafs | — | — |
| openafs | openafs | — | — |
| openafs | openafs | — | — |
| openafs | openafs | — | — |
| openafs | openafs | — | — |
| openafs | openafs | — | — |
| openafs | openafs | — | — |
| openafs | openafs | — | — |
| openafs | openafs | — | — |
| openafs | openafs | — | — |
| openafs | openafs | — | — |
| openafs | openafs | — | — |
| openafs | openafs | — | — |
| openafs | openafs | — | — |
| openafs | openafs | — | — |
| openafs | openafs | — | — |
| openafs | openafs | — | — |
CVSS provenance
nvdv2.07.8HIGHAV:N/AC:L/Au:N/C:N/I:N/A:C
osv7.8HIGH
vendor_debian7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-cpqp-v482-xxhg: The cache manager in the client in OpenAFS 1
ghsa_unreviewed·2022-05-02
CVE-2009-1250 [HIGH] GHSA-cpqp-v482-xxhg: The cache manager in the client in OpenAFS 1
The cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58, and IBM AFS 3.6 before Patch 19, on Linux allows remote attackers to cause a denial of service (system crash) via an RX response with a large error-code value that is interpreted as a pointer and dereferenced, related to use of the ERR_PTR macro.
OSV
CVE-2009-1250: The cache manager in the client in OpenAFS 1
osv·2009-04-09·CVSS 7.8
CVE-2009-1250 [HIGH] CVE-2009-1250: The cache manager in the client in OpenAFS 1
The cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58, and IBM AFS 3.6 before Patch 19, on Linux allows remote attackers to cause a denial of service (system crash) via an RX response with a large error-code value that is interpreted as a pointer and dereferenced, related to use of the ERR_PTR macro.
Debian
CVE-2009-1250: openafs - The cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1...
vendor_debian·2009·CVSS 7.8
CVE-2009-1250 [HIGH] CVE-2009-1250: openafs - The cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1...
The cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58, and IBM AFS 3.6 before Patch 19, on Linux allows remote attackers to cause a denial of service (system crash) via an RX response with a large error-code value that is interpreted as a pointer and dereferenced, related to use of the ERR_PTR macro.
Scope: local
bookworm: resolved (fixed in 1.4.10+dfsg1-1)
bullseye: resolved (fixed in 1.4.10+dfsg1-1)
sid: resolved (fixed in 1.4.10+dfsg1-1)
trixie: resolved (fixed in 1.4.10+dfsg1-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://secunia.com/advisories/34655http://secunia.com/advisories/34684http://secunia.com/advisories/36310http://secunia.com/advisories/42896http://security.gentoo.org/glsa/glsa-201101-05.xmlhttp://www-01.ibm.com/support/docview.wss?uid=swg21396389http://www-1.ibm.com/support/docview.wss?uid=swg1ID71123http://www.debian.org/security/2009/dsa-1768http://www.mandriva.com/security/advisories?name=MDVSA-2009:099http://www.openafs.org/security/OPENAFS-SA-2009-002.txthttp://www.openafs.org/security/openafs-sa-2009-002.patchhttp://www.securityfocus.com/bid/34404http://www.vupen.com/english/advisories/2009/0984http://www.vupen.com/english/advisories/2011/0117http://secunia.com/advisories/34655http://secunia.com/advisories/34684http://secunia.com/advisories/36310http://secunia.com/advisories/42896http://security.gentoo.org/glsa/glsa-201101-05.xmlhttp://www-01.ibm.com/support/docview.wss?uid=swg21396389http://www-1.ibm.com/support/docview.wss?uid=swg1ID71123http://www.debian.org/security/2009/dsa-1768http://www.mandriva.com/security/advisories?name=MDVSA-2009:099http://www.openafs.org/security/OPENAFS-SA-2009-002.txthttp://www.openafs.org/security/openafs-sa-2009-002.patchhttp://www.securityfocus.com/bid/34404http://www.vupen.com/english/advisories/2009/0984http://www.vupen.com/english/advisories/2011/0117
2009-04-09
Published