CVE-2018-16947
First published: Wed Sep 12 2018(Updated: )
An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. The backup tape controller (butc) process accepts incoming RPCs but does not require (or allow for) authentication of those RPCs. Handling those RPCs results in operations being performed with administrator credentials, including dumping/restoring volume contents and manipulating the backup database. For example, an unauthenticated attacker can replace any volume's content with arbitrary data.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/openafs | 1.8.2-1+deb10u1 1.8.6-5 1.8.9-1 1.8.10-1 | |
| npm | <1.6.23 | |
| npm | >=1.8.0<1.8.2 | |
| Debian | =8.0 | |
| Debian | =9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2018-16947?
CVE-2018-16947 has a high severity rating due to its potential for unauthorized administrative access.
How do I fix CVE-2018-16947?
To fix CVE-2018-16947, upgrade OpenAFS to version 1.8.2 or later.
What types of systems are affected by CVE-2018-16947?
CVE-2018-16947 affects OpenAFS versions prior to 1.6.23 and 1.8.0 through 1.8.1.
What are the potential consequences of not addressing CVE-2018-16947?
Failure to address CVE-2018-16947 may lead to unauthorized access to sensitive operations with administrative privileges.
Is CVE-2018-16947 related to any particular RPC vulnerabilities?
Yes, CVE-2018-16947 is related to an authentication flaw in the backup tape controller process that allows unauthenticated RPCs.
- collector/security-tracker-debian
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/severity
- agent/weakness
- agent/references
- agent/last-modified-date
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- package-manager/debian
- vendor/openafs
- canonical/npm
- version/npm/1.8.0
- vendor/debian
- canonical/debian
- version/debian/8.0
- version/debian/9.0