CVE-2007-1507

Опубликовано: 20 мар. 2007

Источник: nvd

CVSS2: 7.5

EPSS Низкий

Описание

The default configuration in OpenAFS 1.4.x before 1.4.4 and 1.5.x before 1.5.17 supports setuid programs within the local cell, which might allow attackers to gain privileges by spoofing a response to an AFS cache manager FetchStatus request, and setting setuid and root ownership for files in the cache.

Ссылки

http://secunia.com/advisories/24582
Vendor Advisory
http://secunia.com/advisories/24599
Vendor Advisory
http://secunia.com/advisories/24607
Vendor Advisory
http://secunia.com/advisories/24720
http://security.gentoo.org/glsa/glsa-200704-03.xml
http://www.debian.org/security/2007/dsa-1271
Vendor Advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2007:066
http://www.openafs.org/pipermail/openafs-announce/2007/000185.html
Vendor Advisory
http://www.openafs.org/pipermail/openafs-announce/2007/000186.html
Patch
Vendor Advisory
http://www.openafs.org/pipermail/openafs-announce/2007/000187.html
http://www.securityfocus.com/bid/23060
http://www.securitytracker.com/id?1017807
http://www.vupen.com/english/advisories/2007/1033
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/33180
http://secunia.com/advisories/24582
Vendor Advisory
http://secunia.com/advisories/24599
Vendor Advisory
http://secunia.com/advisories/24607
Vendor Advisory
http://secunia.com/advisories/24720
http://security.gentoo.org/glsa/glsa-200704-03.xml
http://www.debian.org/security/2007/dsa-1271
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:openafs:openafs:1.4.0:*:*:*:*:*:*:*

cpe:2.3:a:openafs:openafs:1.4.1:*:*:*:*:*:*:*

cpe:2.3:a:openafs:openafs:1.4.2:*:*:*:*:*:*:*

cpe:2.3:a:openafs:openafs:1.4.3:*:*:*:*:*:*:*

cpe:2.3:a:openafs:openafs:1.4.4:*:*:*:*:*:*:*

cpe:2.3:a:openafs:openafs:1.5.0:*:*:*:*:*:*:*

cpe:2.3:a:openafs:openafs:1.5.1:*:*:*:*:*:*:*

cpe:2.3:a:openafs:openafs:1.5.2:*:*:*:*:*:*:*

cpe:2.3:a:openafs:openafs:1.5.3:*:*:*:*:*:*:*

cpe:2.3:a:openafs:openafs:1.5.5:*:*:*:*:*:*:*

cpe:2.3:a:openafs:openafs:1.5.6:*:*:*:*:*:*:*

cpe:2.3:a:openafs:openafs:1.5.7:*:*:*:*:*:*:*

cpe:2.3:a:openafs:openafs:1.5.8:*:*:*:*:*:*:*

cpe:2.3:a:openafs:openafs:1.5.9:*:*:*:*:*:*:*

cpe:2.3:a:openafs:openafs:1.5.10:*:*:*:*:*:*:*

cpe:2.3:a:openafs:openafs:1.5.11:*:*:*:*:*:*:*

cpe:2.3:a:openafs:openafs:1.5.12:*:*:*:*:*:*:*

cpe:2.3:a:openafs:openafs:1.5.13:*:*:*:*:*:*:*

cpe:2.3:a:openafs:openafs:1.5.14:*:*:*:*:*:*:*

cpe:2.3:a:openafs:openafs:1.5.15:*:*:*:*:*:*:*

cpe:2.3:a:openafs:openafs:1.5.16:*:*:*:*:*:*:*

EPSS

Процентиль: 79%

0.01327

Низкий

7.5 High

CVSS2

Дефекты

CWE-16

Связанные уязвимости

CVE-2007-1507

ubuntu

больше 18 лет назад

CVE-2007-1507

debian

больше 18 лет назад

The default configuration in OpenAFS 1.4.x before 1.4.4 and 1.5.x befo ...

GHSA-52gf-7jph-c2gx

github

больше 3 лет назад

BDU:2015-09560

fstec

больше 18 лет назад

Уязвимость операционной системы Gentoo Linux, позволяющая удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации

EPSS

Процентиль: 79%

0.01327

Низкий

7.5 High

CVSS2

Дефекты

CWE-16