CVE-2017-17432

High

Published: 06/12/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

OpenAFS versions 1.x before 1.6.22 do not properly validate Rx ack packets, allowing remote attackers to cause a denial of service (system crash or application crash) via crafted fields.

Risk Assessment

Attackers can exploit this vulnerability to destabilize the system, potentially leading to service outages.

Recommendation

It is recommended to upgrade OpenAFS to version 1.6.22 or later to mitigate this vulnerability.

Other vulnerabilities in OpenAFS

CVE-2015-8312High
Off-by-one error in afs_pioctl.c in OpenAFS before 1.6.16 might allow local users to cause a denial of service (memory overwrite and system crash) via a pioctl with an input buffer size of 4096 bytes.

Original NVD description (English source)

OpenAFS 1.x before 1.6.22 does not properly validate Rx ack packets, which allows remote attackers to cause a denial of service (system crash or application crash) via crafted fields, as demonstrated by an integer underflow and assertion failure for a small MTU value.