cbcvebase.
CVE-2016-2860
published 2016-05-13

CVE-2016-2860: The newEntry function in ptserver/ptprocs.c in OpenAFS before 1.6.17 allows remote authenticated users from foreign Kerberos realms to bypass intended access…

medium6.5CVSS 3.0
AVNACLPRLUINSUCNIHAN
The newEntry function in ptserver/ptprocs.c in OpenAFS before 1.6.17 allows remote authenticated users from foreign Kerberos realms to bypass intended access restrictions and create arbitrary groups as administrators by leveraging mishandling of the creator ID.

Affected

6 ranges
VendorProductVersion rangeFixed in
debiandebian_linux
debianopenafs< openafs 1.6.17-1 (bookworm)openafs 1.6.17-1 (bookworm)
openafsopenafs<= 1.6.16
openafsopenafs>= 0 < 1.6.17-11.6.17-1
openafsopenafs>= 0 < 1.6.17-11.6.17-1
openafsopenafs>= 0 < 1.6.17-11.6.17-1

CVSS provenance

nvdv3.06.5MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
osv6.5MEDIUM