OpenAFS CVE-2018-16948 Memory Leak Information Disclosure Vulnerability

Bugtraq ID:	106368
Class:	Design Error
CVE:	CVE-2018-16948
Remote:	Yes
Local:	No
Published:	Sep 11 2018 12:00AM
Updated:	Sep 11 2018 12:00AM
Credit:	Mark Vitale
Vulnerable:	OpenAFS Openafs 1.8.1 OpenAFS Openafs 1.8 OpenAFS Openafs 1.7.33 OpenAFS Openafs 1.7.32 OpenAFS Openafs 1.7.31 OpenAFS Openafs 1.7.30 OpenAFS Openafs 1.7.29 OpenAFS OpenAFS 1.7.28 OpenAFS Openafs 1.7.27 OpenAFS OpenAFS 1.7.26 OpenAFS OpenAFS 1.7.25 OpenAFS Openafs 1.7.22 OpenAFS Openafs 1.7.21 OpenAFS Openafs 1.7.17 OpenAFS Openafs 1.7.16 OpenAFS Openafs 1.6.22 OpenAFS Openafs 1.6.21 OpenAFS Openafs 1.6.20 OpenAFS Openafs 1.6.17 OpenAFS Openafs 1.6.15 OpenAFS Openafs 1.6.14 OpenAFS Openafs 1.6.13 OpenAFS Openafs 1.6.12 OpenAFS Openafs 1.6.11 OpenAFS Openafs 1.6.10 OpenAFS Openafs 1.6.9 OpenAFS Openafs 1.6.5 2 OpenAFS OpenAFS 1.6.5 OpenAFS OpenAFS 1.6.4 OpenAFS OpenAFS 1.6.3 OpenAFS Openafs 1.6.2 .1 OpenAFS OpenAFS 1.6.2 OpenAFS OpenAFS 1.6.1 OpenAFS OpenAFS 1.6 OpenAFS Openafs 1.5.78 OpenAFS Openafs 1.5.77 OpenAFS Openafs 1.5.76 OpenAFS Openafs 1.5.75 OpenAFS OpenAFS 1.5.58 OpenAFS OpenAFS 1.5.28 OpenAFS OpenAFS 1.5.27 OpenAFS OpenAFS 1.5.19 OpenAFS OpenAFS 1.5.18 OpenAFS OpenAFS 1.5.17 OpenAFS OpenAFS 1.5.16 OpenAFS OpenAFS 1.5.15 OpenAFS OpenAFS 1.5.14 OpenAFS OpenAFS 1.5.13 OpenAFS OpenAFS 1.5.12 OpenAFS OpenAFS 1.5.11 OpenAFS OpenAFS 1.5.10 OpenAFS OpenAFS 1.5.9 OpenAFS OpenAFS 1.5.8 OpenAFS OpenAFS 1.5.7 OpenAFS OpenAFS 1.5.6 OpenAFS OpenAFS 1.5.5 OpenAFS OpenAFS 1.5.4 OpenAFS OpenAFS 1.5.3 OpenAFS OpenAFS 1.5.2 OpenAFS OpenAFS 1.5.1 OpenAFS OpenAFS 1.5 OpenAFS OpenAFS 1.4.15 OpenAFS Openafs 1.4.10 OpenAFS OpenAFS 1.4.8 OpenAFS OpenAFS 1.4.6 OpenAFS OpenAFS 1.4.5 OpenAFS OpenAFS 1.4.4 OpenAFS OpenAFS 1.4.3 OpenAFS OpenAFS 1.4.2 OpenAFS OpenAFS 1.4.1 OpenAFS OpenAFS 1.4 OpenAFS OpenAFS 1.3.81 OpenAFS OpenAFS 1.3.64 OpenAFS OpenAFS 1.3.50 OpenAFS OpenAFS 1.3.2 OpenAFS OpenAFS 1.3.1 OpenAFS OpenAFS 1.3 OpenAFS OpenAFS 1.2.9 OpenAFS OpenAFS 1.2.8 OpenAFS OpenAFS 1.2.7 OpenAFS OpenAFS 1.2.6 OpenAFS OpenAFS 1.2.5 OpenAFS OpenAFS 1.2.4 OpenAFS OpenAFS 1.2.3 + Debian Linux 3.0 OpenAFS OpenAFS 1.2.2 b OpenAFS OpenAFS 1.2.2 a OpenAFS OpenAFS 1.2.2 OpenAFS OpenAFS 1.2.1 OpenAFS OpenAFS 1.2 OpenAFS OpenAFS 1.1.1 a OpenAFS OpenAFS 1.1.1 OpenAFS OpenAFS 1.1 OpenAFS OpenAFS 1.0.4 a OpenAFS OpenAFS 1.0.4 OpenAFS OpenAFS 1.0.3 OpenAFS OpenAFS 1.0.2 OpenAFS OpenAFS 1.0.1 OpenAFS OpenAFS 1.0 OpenAFS Openafs 1.7.8 OpenAFS Openafs 1.7.4 OpenAFS Openafs 1.7.3 OpenAFS Openafs 1.7.24 OpenAFS Openafs 1.7.23 OpenAFS Openafs 1.7.20 OpenAFS Openafs 1.7.2 OpenAFS Openafs 1.7.19 OpenAFS Openafs 1.7.18 OpenAFS Openafs 1.7.15 OpenAFS Openafs 1.7.14 OpenAFS Openafs 1.7.13 OpenAFS Openafs 1.7.12 OpenAFS Openafs 1.7.11 OpenAFS Openafs 1.7.10 OpenAFS Openafs 1.7.1 OpenAFS Openafs 1.6.8 OpenAFS Openafs 1.6.7 OpenAFS Openafs 1.6.6 OpenAFS Openafs 1.6.5.1 OpenAFS Openafs 1.6.19 OpenAFS Openafs 1.6.18 OpenAFS Openafs 1.4.9 OpenAFS Openafs 1.4.14.1 OpenAFS OpenAFS 1.4.14 OpenAFS OpenAFS 1.4.13 OpenAFS Openafs 1.4.12 OpenAFS Openafs 1.4.11
Not Vulnerable:	OpenAFS Openafs 1.8.2 OpenAFS Openafs 1.6.23

OpenAFS CVE-2018-16948 Memory Leak Information Disclosure Vulnerability

OpenAFS is prone to an information-disclosure vulnerability.

Attackers can exploit this issue to obtain sensitive information that may lead to further attacks.

The following versions are affected:

OpenAFS 1.0 through 1.6.22
OpenAFS 1.8.0 through 1.8.1

OpenAFS CVE-2018-16948 Memory Leak Information Disclosure Vulnerability

References:

• OpenAFS Homepage (OpenAFS)
  
• OpenAFS Product Page (OpenAFS)
  
• OpenAFS Security Advisory-2018-002 (OpenAFS)