Vulnerability Description
Race condition in fileserver in OpenAFS 1.3.50 through 1.4.5 and 1.5.0 through 1.5.27 allows remote attackers to cause a denial of service (daemon crash) by simultaneously acquiring and giving back file callbacks, which causes the handler for the GiveUpAllCallBacks RPC to perform linked-list operations without the host_glock lock.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openafs | Openafs | >= 1.3.50, <= 1.4.5 |
| Debian | Debian Linux | 3.1 |
Related Weaknesses (CWE)
References
- http://lists.openafs.org/pipermail/openafs-announce/2007/000220.htmlVendor Advisory
- http://secunia.com/advisories/28327Third Party Advisory
- http://secunia.com/advisories/28401Third Party Advisory
- http://secunia.com/advisories/28433Third Party Advisory
- http://secunia.com/advisories/28636Third Party Advisory
- http://security.gentoo.org/glsa/glsa-200801-04.xmlThird Party Advisory
- http://www.debian.org/security/2008/dsa-1458Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:207Third Party Advisory
- http://www.novell.com/linux/security/advisories/suse_security_summary_report.htmThird Party Advisory
- http://www.openafs.org/security/OPENAFS-SA-2007-003.txtVendor Advisory
- http://www.securityfocus.com/bid/27132Third Party AdvisoryVDB Entry
- http://www.vupen.com/english/advisories/2008/0046Third Party Advisory
- http://lists.openafs.org/pipermail/openafs-announce/2007/000220.htmlVendor Advisory
- http://secunia.com/advisories/28327Third Party Advisory
- http://secunia.com/advisories/28401Third Party Advisory
FAQ
What is CVE-2007-6599?
CVE-2007-6599 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Race condition in fileserver in OpenAFS 1.3.50 through 1.4.5 and 1.5.0 through 1.5.27 allows remote attackers to cause a denial of service (daemon crash) by simultaneously acquiring and giving back fi...
How severe is CVE-2007-6599?
CVE-2007-6599 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2007-6599?
Check the references section above for vendor advisories and patch information. Affected products include: Openafs Openafs, Debian Debian Linux.