CVE-2007-1507

The default configuration in OpenAFS 1.4.x before 1.4.4 and 1.5.x before 1.5.17 supports setuid programs within the local cell, which might allow attackers to gain privileges by spoofing a response to an AFS cache manager FetchStatus request, and setting setuid and root ownership for files in the cache.

Affected Software

Name	Vendor	Start Version	End Version
Openafs	Openafs	1.4.0 (including)	1.4.0 (including)
Openafs	Openafs	1.4.1 (including)	1.4.1 (including)
Openafs	Openafs	1.4.2 (including)	1.4.2 (including)
Openafs	Openafs	1.4.3 (including)	1.4.3 (including)
Openafs	Openafs	1.4.4 (including)	1.4.4 (including)
Openafs	Openafs	1.5.0 (including)	1.5.0 (including)
Openafs	Openafs	1.5.1 (including)	1.5.1 (including)
Openafs	Openafs	1.5.2 (including)	1.5.2 (including)
Openafs	Openafs	1.5.3 (including)	1.5.3 (including)
Openafs	Openafs	1.5.5 (including)	1.5.5 (including)
Openafs	Openafs	1.5.6 (including)	1.5.6 (including)
Openafs	Openafs	1.5.7 (including)	1.5.7 (including)
Openafs	Openafs	1.5.8 (including)	1.5.8 (including)
Openafs	Openafs	1.5.9 (including)	1.5.9 (including)
Openafs	Openafs	1.5.10 (including)	1.5.10 (including)
Openafs	Openafs	1.5.11 (including)	1.5.11 (including)
Openafs	Openafs	1.5.12 (including)	1.5.12 (including)
Openafs	Openafs	1.5.13 (including)	1.5.13 (including)
Openafs	Openafs	1.5.14 (including)	1.5.14 (including)
Openafs	Openafs	1.5.15 (including)	1.5.15 (including)
Openafs	Openafs	1.5.16 (including)	1.5.16 (including)
Openafs	Ubuntu	dapper	*
Openafs	Ubuntu	devel	*
Openafs	Ubuntu	edgy	*
Openafs	Ubuntu	feisty	*
Openafs	Ubuntu	gutsy	*
Openafs	Ubuntu	hardy	*
Openafs	Ubuntu	intrepid	*
Openafs	Ubuntu	upstream	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2007-1507
CWE	https://cwe.mitre.org/data/definitions/16.html

Affected Software

References