Vulnerability Description
The cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58, and IBM AFS 3.6 before Patch 19, on Linux allows remote attackers to cause a denial of service (system crash) via an RX response with a large error-code value that is interpreted as a pointer and dereferenced, related to use of the ERR_PTR macro.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ibm | Afs | <= 3.6 |
| Openafs | Openafs | 1.0 |
| Linux | Linux Kernel | All versions |
Related Weaknesses (CWE)
References
- http://secunia.com/advisories/34655
- http://secunia.com/advisories/34684
- http://secunia.com/advisories/36310
- http://secunia.com/advisories/42896
- http://security.gentoo.org/glsa/glsa-201101-05.xml
- http://www-01.ibm.com/support/docview.wss?uid=swg21396389
- http://www-1.ibm.com/support/docview.wss?uid=swg1ID71123
- http://www.debian.org/security/2009/dsa-1768
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:099
- http://www.openafs.org/security/OPENAFS-SA-2009-002.txt
- http://www.openafs.org/security/openafs-sa-2009-002.patchExploit
- http://www.securityfocus.com/bid/34404
- http://www.vupen.com/english/advisories/2009/0984
- http://www.vupen.com/english/advisories/2011/0117
- http://secunia.com/advisories/34655
FAQ
What is CVE-2009-1250?
CVE-2009-1250 is a vulnerability with a CVSS score of 7.8 (HIGH). The cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58, and IBM AFS 3.6 before Patch 19, on Linux allows remote attackers to cause a denial of service (system crash) via...
How severe is CVE-2009-1250?
CVE-2009-1250 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2009-1250?
Check the references section above for vendor advisories and patch information. Affected products include: Ibm Afs, Openafs Openafs, Linux Linux Kernel.