CVE-2016-4536: Infoleak
Published May 13, 2016
·Updated
The client in OpenAFS before 1.6.17 does not properly initialize the (1) AFSStoreStatus, (2) AFSStoreVolumeStatus, (3) VldbListByAttributes, and (4) ListAddrByAttributes structures, which might allow remote attackers to obtain sensitive memory information by leveraging access to RPC call traffic.
Affected Software
1 affected component
OpenAFS OpenAFS<=1.6.16
Event History
May 13, 2016
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-4536?
CVE-2016-4536 is classified as a medium severity vulnerability due to the potential for sensitive information exposure.
2
How do I fix CVE-2016-4536?
To fix CVE-2016-4536, upgrade OpenAFS to version 1.6.17 or later.
3
What types of information could be exposed due to CVE-2016-4536?
CVE-2016-4536 may allow remote attackers to obtain sensitive memory information from the affected OpenAFS client.
4
Is CVE-2016-4536 exploitable remotely?
Yes, attackers can exploit CVE-2016-4536 remotely by leveraging access to RPC call traffic.
5
Which versions of OpenAFS are affected by CVE-2016-4536?
CVE-2016-4536 affects OpenAFS versions prior to 1.6.17.