NVD

Id
18843  
Name
CVE-2016-2860  
Description
The newEntry function in ptserver/ptprocs.c in OpenAFS before 1.6.17 allows remote authenticated users from foreign Kerberos realms to bypass intended access restrictions and create arbitrary groups as administrators by leveraging mishandling of the creator ID.  
Reject
 
CVSS Version
2  
CVSS Score
4  
Severity
Medium  
CVSS Base Score
4  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8  
CVSS Vector
(AV:N/AC:L/Au:S/C:N/I:P/A:N)  
Pub Date
2017-01-19  
Published
2016-05-13  
Modified Date
2016-05-19  
Seq
2016-2860  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
104675 18843 CVE-2016-2860 http://git.openafs.org/?p=openafs.git;a=commitdiff;h=396240cf070a806b91fea81131d034e1399af1e0  View
104676 18843 CVE-2016-2860 DSA-3569  View
104677 18843 CVE-2016-2860 http://www.openafs.org/pages/security/OPENAFS-SA-2016-001.txt  View
104678 18843 CVE-2016-2860 [OpenAFS-announce] 20160316 OpenAFS security release 1.6.17 available  View
104679 18843 CVE-2016-2860 https://www.openafs.org/dl/openafs/1.6.17/RELNOTES-1.6.17  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
1991 JVNDB-2016-002764 OpenAFS の ptserver/ptprocs.c の newEntry 関数におけるアクセス制限を回避される脆弱性 OpenAFS の ptserver/ptprocs.c の newEntry 関数には、アクセス制限を回避され、任意のグループを管理者として作成される脆弱性が存在します。 CVE-2016-2860 89366 CVE-2016-2860 18843 4 6.5 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-002764.html 2016-03-16 2016-05-20 View