CVE-2009-1251: Buffer Overflow

Published Apr 9, 2009

Updated

Heap-based buffer overflow in the cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58 on Unix platforms allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via an RX response containing more data than specified in a request, related to use of XDR arrays.

Affected Software

72 affected components

Unix

OpenAFS OpenAFS=1.0

OpenAFS OpenAFS=1.0.1

OpenAFS OpenAFS=1.0.2

OpenAFS OpenAFS=1.0.3

OpenAFS OpenAFS=1.0.4

OpenAFS OpenAFS=1.0.4a

OpenAFS OpenAFS=1.1

OpenAFS OpenAFS=1.1.0

OpenAFS OpenAFS=1.1.1

OpenAFS OpenAFS=1.1.1a

OpenAFS OpenAFS=1.2

OpenAFS OpenAFS=1.2.1

OpenAFS OpenAFS=1.2.2

OpenAFS OpenAFS=1.2.2a

OpenAFS OpenAFS=1.2.2b

OpenAFS OpenAFS=1.2.3

OpenAFS OpenAFS=1.2.4

OpenAFS OpenAFS=1.2.5

OpenAFS OpenAFS=1.2.6

OpenAFS OpenAFS=1.2.7

OpenAFS OpenAFS=1.2.8

OpenAFS OpenAFS=1.2.9

OpenAFS OpenAFS=1.2.10

OpenAFS OpenAFS=1.2.11

OpenAFS OpenAFS=1.2.13

OpenAFS OpenAFS=1.3

OpenAFS OpenAFS=1.3.1

OpenAFS OpenAFS=1.3.2

OpenAFS OpenAFS=1.3.5

OpenAFS OpenAFS=1.3.70

OpenAFS OpenAFS=1.3.74

OpenAFS OpenAFS=1.3.77

OpenAFS OpenAFS=1.3.81

OpenAFS OpenAFS=1.4

OpenAFS OpenAFS=1.4.0

OpenAFS OpenAFS=1.4.3

OpenAFS OpenAFS=1.4.4

OpenAFS OpenAFS=1.4.5

OpenAFS OpenAFS=1.4.6

OpenAFS OpenAFS=1.4.7

OpenAFS OpenAFS=1.4.7_pre1

OpenAFS OpenAFS=1.4.7_pre2

OpenAFS OpenAFS=1.4.7_pre3

OpenAFS OpenAFS=1.4.7_pre4

OpenAFS OpenAFS=1.4.7_pre5

OpenAFS OpenAFS=1.4.8

OpenAFS OpenAFS=1.4.8_pre1

OpenAFS OpenAFS=1.4.8_pre2

OpenAFS OpenAFS=1.4.8_pre3

OpenAFS OpenAFS=1.5

OpenAFS OpenAFS=1.5.16

OpenAFS OpenAFS=1.5.17

OpenAFS OpenAFS=1.5.26

OpenAFS OpenAFS=1.5.27

OpenAFS OpenAFS=1.5.30

OpenAFS OpenAFS=1.5.31

OpenAFS OpenAFS=1.5.32

OpenAFS OpenAFS=1.5.33

OpenAFS OpenAFS=1.5.34

OpenAFS OpenAFS=1.5.35

OpenAFS OpenAFS=1.5.36

OpenAFS OpenAFS=1.5.38

OpenAFS OpenAFS=1.5.39

OpenAFS OpenAFS=1.5.50

OpenAFS OpenAFS=1.5.52

OpenAFS OpenAFS=1.5.53

OpenAFS OpenAFS=1.5.54

OpenAFS OpenAFS=1.5.55

OpenAFS OpenAFS=1.5.56

OpenAFS OpenAFS=1.5.57

OpenAFS OpenAFS=1.5.58

Remediation

Patch Available

http://www.openafs.org/security/openafs-sa-2009-001.patch

Event History

Apr 9, 2009

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

12:30 AM

DescriptionWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2009-1251?

CVE-2009-1251 has a high severity rating as it allows remote attackers to potentially execute arbitrary code or cause a denial of service.

How do I fix CVE-2009-1251?

To fix CVE-2009-1251, upgrade OpenAFS to version 1.5.59 or later, which includes patches to address this vulnerability.

What software versions are affected by CVE-2009-1251?

CVE-2009-1251 affects OpenAFS versions 1.0 through 1.4.8 and versions 1.5.0 through 1.5.58 on Unix platforms.

Can CVE-2009-1251 lead to a system crash?

Yes, CVE-2009-1251 can cause a denial of service resulting in a system crash due to the buffer overflow in the cache manager.

What are the potential impacts of exploiting CVE-2009-1251?

Exploiting CVE-2009-1251 can lead to remote code execution and denial of service, compromising the security and stability of affected systems.