| Vulnerability Name: | CVE-2016-4536 (CCN-113000) | ||||||||||||||||||||||||||||||||||||||||||||
| Assigned: | 2016-05-05 | ||||||||||||||||||||||||||||||||||||||||||||
| Published: | 2016-05-05 | ||||||||||||||||||||||||||||||||||||||||||||
| Updated: | 2016-05-19 | ||||||||||||||||||||||||||||||||||||||||||||
| Summary: | The client in OpenAFS before 1.6.17 does not properly initialize the (1) AFSStoreStatus, (2) AFSStoreVolumeStatus, (3) VldbListByAttributes, and (4) ListAddrByAttributes structures, which might allow remote attackers to obtain sensitive memory information by leveraging access to RPC call traffic. | ||||||||||||||||||||||||||||||||||||||||||||
| CVSS v3 Severity: | 5.3 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) 4.6 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C)
4.6 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C)
| ||||||||||||||||||||||||||||||||||||||||||||
| CVSS v2 Severity: | 5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
| ||||||||||||||||||||||||||||||||||||||||||||
| Vulnerability Type: | CWE-200 | ||||||||||||||||||||||||||||||||||||||||||||
| Vulnerability Consequences: | Obtain Information | ||||||||||||||||||||||||||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2016-4536 Source: CCN Type: oss-sec Mailing List, Thu, 5 May 2016 15:32:01 +0200 CVE Request: OpenAFS: OPENAFS-SA-2016-002 - various client functionality leak stack data onto the wire in the clear Source: CCN Type: oss-sec Mailing List, Thu, 5 May 2016 17:59:43 -0400 (EDT) Re: CVE Request: OpenAFS: OPENAFS-SA-2016-002 - various client functionality leak stack data onto the wire in the clear Source: XF Type: UNKNOWN openafs-cve20164536-info-disc(113000) Source: MLIST Type: Vendor Advisory [OpenAFS-announce] 20160316 OpenAFS security release 1.6.17 available Source: CONFIRM Type: Vendor Advisory https://www.openafs.org/dl/openafs/1.6.17/RELNOTES-1.6.17 Source: CCN Type: OpenAFS Security Advisory 2016-002 Topic: information leakage from client memory Source: CONFIRM Type: Vendor Advisory https://www.openafs.org/pages/security/OPENAFS-SA-2016-002.txt Source: CCN Type: WhiteSource Vulnerability Database CVE-2016-4536 | ||||||||||||||||||||||||||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||||||||||||||||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||||||||||||||||||
| BACK | |||||||||||||||||||||||||||||||||||||||||||||