Vulnerability Details : CVE-2009-1250
The cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58, and IBM AFS 3.6 before Patch 19, on Linux allows remote attackers to cause a denial of service (system crash) via an RX response with a large error-code value that is interpreted as a pointer and dereferenced, related to use of the ERR_PTR macro.
Vulnerability category: Denial of service
Products affected by CVE-2009-1250
- cpe:2.3:a:ibm:afs:*:patch18:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:ibm:afs:3.6:patch15:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:ibm:afs:3.6:patch16:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:ibm:afs:3.6:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:ibm:afs:3.6:patch14:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:ibm:afs:3.6:patch13:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:ibm:afs:3.6:patch12:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.0.4a:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.1:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.2.3:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.2.4:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.0:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.1.1:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.1.1a:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.2:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.2.5:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.2.6:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.0.1:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.0.2:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.2.1:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.2.2:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.3:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.3.1:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.0.3:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.0.4:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.2.2a:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.2.2b:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.3.2:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.5.16:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.4.3:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.4.4:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.4.0:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.5:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.3.5:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.4.5:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.5.33:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.5.34:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.2.7:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.5.31:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.5.32:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.5.50:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.5.53:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.4.6:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.4.7:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.4.8_pre2:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.4.8_pre3:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.3.74:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.3.70:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.3.77:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.2.9:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.5.17:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.5.27:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.5.35:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.5.36:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.5.52:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.5.57:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.4.7_pre3:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.4.7_pre4:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.1.0:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.2.10:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.5.54:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.5.55:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.5.56:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.4.7_pre1:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.4.7_pre2:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.4.8:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.4:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.2.8:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.3.81:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.5.26:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.5.30:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.5.38:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.5.39:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.5.58:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.4.7_pre5:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.4.8_pre1:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.2.11:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:openafs:openafs:1.2.13:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
Exploit prediction scoring system (EPSS) score for CVE-2009-1250
4.29%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 91 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2009-1250
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.8
|
HIGH | AV:N/AC:L/Au:N/C:N/I:N/A:C |
10.0
|
6.9
|
NIST |
CWE ids for CVE-2009-1250
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2009-1250
-
http://www.securityfocus.com/bid/34404
-
http://www-1.ibm.com/support/docview.wss?uid=swg1ID71123
IBM notice: The page you requested cannot be displayed
-
http://security.gentoo.org/glsa/glsa-201101-05.xml
OpenAFS: Arbitrary code execution (GLSA 201101-05) — Gentoo security
-
http://www.openafs.org/security/OPENAFS-SA-2009-002.txt
OpenAFS
-
http://www.vupen.com/english/advisories/2009/0984
Site en construction
-
http://www-01.ibm.com/support/docview.wss?uid=swg21396389
AFS V 3.6 Patch 19 README
-
http://www.vupen.com/english/advisories/2011/0117
Site en construction
-
http://www.debian.org/security/2009/dsa-1768
[SECURITY] [DSA 1768-1] New openafs packages potential code execution
-
http://www.openafs.org/security/openafs-sa-2009-002.patch
OpenAFSExploit
-
http://www.mandriva.com/security/advisories?name=MDVSA-2009:099
Mandriva
Jump to