CVEvulnerability
CVE-2016-2860
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2016-05-13
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 6.5 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- CVSS 2.0 ([email protected])
- 4.0 MEDIUM — AV:N/AC:L/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-284
Description
The newEntry function in ptserver/ptprocs.c in OpenAFS before 1.6.17 allows remote authenticated users from foreign Kerberos realms to bypass intended access restrictions and create arbitrary groups as administrators by leveraging mishandling of the creator ID.
Affected configurations
• openafs openafs (<= 1.6.16)
• debian debian linux 8.0
Related
Weakness · CWE (1)
- CWE-284 Improper Access Control weakness
References
- http://git.openafs.org/?p=openafs.git%3Ba=commitdiff%3Bh=396240cf070a806b91fea81131d034e1399af1e0 git.openafs.org
- http://www.debian.org/security/2016/dsa-3569 www.debian.org
- http://www.openafs.org/pages/security/OPENAFS-SA-2016-001.txt Vendor Advisory
- https://lists.openafs.org/pipermail/openafs-announce/2016/000496.html lists.openafs.org
- https://www.openafs.org/dl/openafs/1.6.17/RELNOTES-1.6.17 www.openafs.org
- http://git.openafs.org/?p=openafs.git%3Ba=commitdiff%3Bh=396240cf070a806b91fea81131d034e1399af1e0 git.openafs.org
- http://www.debian.org/security/2016/dsa-3569 www.debian.org
- http://www.openafs.org/pages/security/OPENAFS-SA-2016-001.txt Vendor Advisory
- https://lists.openafs.org/pipermail/openafs-announce/2016/000496.html lists.openafs.org
- https://www.openafs.org/dl/openafs/1.6.17/RELNOTES-1.6.17 www.openafs.org