Back to Database
Status published
High
CVE-2007-1507
The default configuration in OpenAFS 1.4.x before 1.4.4 and 1.5.x...
Vulnerability Description
The default configuration in OpenAFS 1.4.x before 1.4.4 and 1.5.x before 1.5.17 supports setuid programs within the local cell, which might allow attackers to gain privileges by spoofing a response to an AFS cache manager FetchStatus request, and setting setuid and root ownership for files in the cache.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2007-1507
Credits & Attribution
No credits recorded in the NVD database.
References
- http://www.vupen.com/english/advisories/2007/1033
- http://secunia.com/advisories/24582
- http://www.securitytracker.com/id?1017807
- http://www.openafs.org/pipermail/openafs-announce/2007/000186.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/33180
- http://www.debian.org/security/2007/dsa-1271
- http://secunia.com/advisories/24720
- http://www.openafs.org/pipermail/openafs-announce/2007/000185.html
- http://secunia.com/advisories/24607
- http://security.gentoo.org/glsa/glsa-200704-03.xml
- http://www.openafs.org/pipermail/openafs-announce/2007/000187.html
- http://www.mandriva.com/security/advisories?name=MDKSA-2007:066
- http://secunia.com/advisories/24599
- http://www.securityfocus.com/bid/23060
More from openafs
View All →CVE-2019-18603
OpenAFS before 1.6.24 and 1.8.x before 1.8.5 is prone to...
Medium
5.9
CVE-2019-18602
OpenAFS before 1.6.24 and 1.8.x before 1.8.5 is prone to...
High
7.5
CVE-2019-18601
OpenAFS before 1.6.24 and 1.8.x before 1.8.5 is prone to...
High
7.5
CVE-2018-16949
An issue was discovered in OpenAFS before 1.6.23 and 1.8.x...
High
7.5
CVE-2018-16948
An issue was discovered in OpenAFS before 1.6.23 and 1.8.x...
High
7.5
Affected Vendor
openafs
View all reports →Affected Software
openafs
Vulnerable Versions:
1.4.0, 1.4.1, 1.4.2, 1.4.3, 1.4.4, 1.5.0, 1.5.1, 1.5.2, 1.5.3, 1.5.5, 1.5.6, 1.5.7, 1.5.8, 1.5.9, 1.5.10, 1.5.11, 1.5.12, 1.5.13, 1.5.14, 1.5.15, 1.5.16
Timeline
Official Publish:
March 20th, 2007
Last Modified:
August 7th, 2024
Added to House:
July 18th, 2026
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.