CVE-2007-1507

Published: Mar 20, 2007Modified: Apr 23, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

The default configuration in OpenAFS 1.4.x before 1.4.4 and 1.5.x before 1.5.17 supports setuid programs within the local cell, which might allow attackers to gain privileges by spoofing a response to an AFS cache manager FetchStatus request, and setting setuid and root ownership for files in the cache.

Affected (21)

Products: Openafs: Openafs

1 product

Configuration A

21 vulnerable

Vulnerable Software	Affected Versions
Openafs Openafs	Version 1.4.0
Openafs Openafs	Version 1.4.1
Openafs Openafs	Version 1.4.2
Openafs Openafs	Version 1.4.3
Openafs Openafs	Version 1.4.4
Openafs Openafs	Version 1.5.0
Openafs Openafs	Version 1.5.10
Openafs Openafs	Version 1.5.11
Openafs Openafs	Version 1.5.12
Openafs Openafs	Version 1.5.13
Openafs Openafs	Version 1.5.14
Openafs Openafs	Version 1.5.15
Openafs Openafs	Version 1.5.16
Openafs Openafs	Version 1.5.1
Openafs Openafs	Version 1.5.2
Openafs Openafs	Version 1.5.3
Openafs Openafs	Version 1.5.5
Openafs Openafs	Version 1.5.6
Openafs Openafs	Version 1.5.7
Openafs Openafs	Version 1.5.8
Openafs Openafs	Version 1.5.9

Related CWEs

References (28)

http://secunia.com/advisories/24582

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/24599

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/24607

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/24720

Source: cve@mitre.org

http://security.gentoo.org/glsa/glsa-200704-03.xml

Source: cve@mitre.org

http://www.debian.org/security/2007/dsa-1271

Source: cve@mitre.org

Vendor Advisory

http://www.mandriva.com/security/advisories?name=MDKSA-2007:066

Source: cve@mitre.org

http://www.openafs.org/pipermail/openafs-announce/2007/000185.html

Source: cve@mitre.org

Vendor Advisory

http://www.openafs.org/pipermail/openafs-announce/2007/000186.html

Source: cve@mitre.org

PatchVendor Advisory

http://www.openafs.org/pipermail/openafs-announce/2007/000187.html

Source: cve@mitre.org

http://www.securityfocus.com/bid/23060

Source: cve@mitre.org

http://www.securitytracker.com/id?1017807

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2007/1033

Source: cve@mitre.org

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/33180

Source: cve@mitre.org

http://secunia.com/advisories/24582

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/24599

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/24607

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/24720

Source: af854a3a-2127-422b-91ae-364da2661108

http://security.gentoo.org/glsa/glsa-200704-03.xml

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2007/dsa-1271

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.mandriva.com/security/advisories?name=MDKSA-2007:066

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openafs.org/pipermail/openafs-announce/2007/000185.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.openafs.org/pipermail/openafs-announce/2007/000186.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://www.openafs.org/pipermail/openafs-announce/2007/000187.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/23060

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id?1017807

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2007/1033

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/33180

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.