Vulnerability Details : CVE-2007-1507
The default configuration in OpenAFS 1.4.x before 1.4.4 and 1.5.x before 1.5.17 supports setuid programs within the local cell, which might allow attackers to gain privileges by spoofing a response to an AFS cache manager FetchStatus request, and setting setuid and root ownership for files in the cache.
Products affected by CVE-2007-1507
- cpe:2.3:a:openafs:openafs:1.5.16:*:*:*:*:*:*:*
- cpe:2.3:a:openafs:openafs:1.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:openafs:openafs:1.5.7:*:*:*:*:*:*:*
- cpe:2.3:a:openafs:openafs:1.5.8:*:*:*:*:*:*:*
- cpe:2.3:a:openafs:openafs:1.4.3:*:*:*:*:*:*:*
- cpe:2.3:a:openafs:openafs:1.4.4:*:*:*:*:*:*:*
- cpe:2.3:a:openafs:openafs:1.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:openafs:openafs:1.5.3:*:*:*:*:*:*:*
- cpe:2.3:a:openafs:openafs:1.5.11:*:*:*:*:*:*:*
- cpe:2.3:a:openafs:openafs:1.5.12:*:*:*:*:*:*:*
- cpe:2.3:a:openafs:openafs:1.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:openafs:openafs:1.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:openafs:openafs:1.5.5:*:*:*:*:*:*:*
- cpe:2.3:a:openafs:openafs:1.5.6:*:*:*:*:*:*:*
- cpe:2.3:a:openafs:openafs:1.5.13:*:*:*:*:*:*:*
- cpe:2.3:a:openafs:openafs:1.5.14:*:*:*:*:*:*:*
- cpe:2.3:a:openafs:openafs:1.5.15:*:*:*:*:*:*:*
- cpe:2.3:a:openafs:openafs:1.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:openafs:openafs:1.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:openafs:openafs:1.5.9:*:*:*:*:*:*:*
- cpe:2.3:a:openafs:openafs:1.5.10:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2007-1507
5.17%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 93 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2007-1507
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST |
CWE ids for CVE-2007-1507
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2007-1507
-
http://www.securitytracker.com/id?1017807
Access Denied
-
http://www.openafs.org/pipermail/openafs-announce/2007/000187.html
[OpenAFS-announce] OpenAFS Security Advisory 2007-001: privilege escalation in Unix-based clients
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/33180
OpenAFS setuid command privilege escalation CVE-2007-1507 Vulnerability Report
-
http://www.debian.org/security/2007/dsa-1271
[SECURITY] [DSA 1271-1] New openafs packages fix remote privilege escalation bugVendor Advisory
-
http://www.securityfocus.com/bid/23060
-
http://www.vupen.com/english/advisories/2007/1033
Site en constructionVendor Advisory
-
http://security.gentoo.org/glsa/glsa-200704-03.xml
OpenAFS: Privilege escalation (GLSA 200704-03) — Gentoo security
-
http://www.mandriva.com/security/advisories?name=MDKSA-2007:066
Mandriva
-
http://www.openafs.org/pipermail/openafs-announce/2007/000185.html
[OpenAFS-announce] OpenAFS 1.4.4 availableVendor Advisory
-
http://www.openafs.org/pipermail/openafs-announce/2007/000186.html
[OpenAFS-announce] OpenAFS 1.5.17 release availablePatch;Vendor Advisory
Jump to