What is the severity of CVE-2018-16949?

CVE-2018-16949 is classified as a high severity vulnerability due to its potential for unauthenticated remote code execution.

How do I fix CVE-2018-16949?

To fix CVE-2018-16949, upgrade OpenAFS to version 1.6.23 or 1.8.2 or later.

What types of software are affected by CVE-2018-16949?

CVE-2018-16949 affects OpenAFS versions before 1.6.23 and 1.8.x before 1.8.2, as well as Debian Linux versions 8.0 and 9.0.

What kind of attack can be executed using CVE-2018-16949?

An attacker can exploit CVE-2018-16949 by sending maliciously large RPC input values to the server.

Is CVE-2018-16949 vulnerable to authenticated attacks?

CVE-2018-16949 is vulnerable to unauthenticated attacks, meaning attackers do not need to be authenticated to exploit the vulnerability.

Vulnerability/
CVE-2018-16949

high

7.5

CWE

400

12/9/2018

5/8/2024

CVE-2018-16949

First published: Wed Sep 12 2018(Updated: )

An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. Several data types used as RPC input variables were implemented as unbounded array types, limited only by the inherent 32-bit length field to 4 GB. An unauthenticated attacker could send, or claim to send, large input values and consume server resources waiting for those inputs, denying service to other valid connections.

Credit: cve@mitre.org

Affected Software	Affected Version	How to fix
npm	<1.6.23
npm	>=1.8.0<1.8.2
Debian Linux	=8.0
Debian Linux	=9.0

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2018-16949?
CVE-2018-16949 is classified as a high severity vulnerability due to its potential for unauthenticated remote code execution.
How do I fix CVE-2018-16949?
To fix CVE-2018-16949, upgrade OpenAFS to version 1.6.23 or 1.8.2 or later.
What types of software are affected by CVE-2018-16949?
CVE-2018-16949 affects OpenAFS versions before 1.6.23 and 1.8.x before 1.8.2, as well as Debian Linux versions 8.0 and 9.0.
What kind of attack can be executed using CVE-2018-16949?
An attacker can exploit CVE-2018-16949 by sending maliciously large RPC input values to the server.
Is CVE-2018-16949 vulnerable to authenticated attacks?
CVE-2018-16949 is vulnerable to unauthenticated attacks, meaning attackers do not need to be authenticated to exploit the vulnerability.

agent/references
agent/type
collector/mitre-cve
source/MITRE
agent/author
agent/severity
agent/weakness
agent/last-modified-date
agent/description
agent/first-publish-date
agent/event
agent/source
agent/softwarecombine
agent/tags
collector/nvd-index
agent/software-canonical-lookup-request
vendor/openafs
canonical/npm
version/npm/1.8.0
vendor/debian
canonical/debian linux
version/debian linux/8.0
version/debian linux/9.0

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.