CVE-2024-10397 - Vulnerability Details - OpenCVE

A malicious server can crash the OpenAFS cache manager and other client utilities, and possibly execute arbitrary code.

Attack Vector Network

Attack Complexity High

Privileges Required None

Attack Requirements Present

User Interaction Passive

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://openafs.org/pages/security/OPENAFS-SA-2024-003.txt

History

Fri, 22 Nov 2024 12:00:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 0.0, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N'}`

Tue, 19 Nov 2024 16:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 0, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 14 Nov 2024 19:45:00 +0000

Type	Values Removed	Values Added
Description		A malicious server can crash the OpenAFS cache manager and other client utilities, and possibly execute arbitrary code.
Weaknesses		CWE-787
References		https://openafs.org/pages/security/OPENAFS-SA-2024-003.txt
Metrics		cvssV4_0 `{'score': 7.7, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`

MITRE

Status: PUBLISHED

Assigner: fedora

Published: 2024-11-14T19:33:15.462Z

Updated: 2024-11-21T16:10:11.231Z

Reserved: 2024-10-25T19:25:51.800Z

Link: CVE-2024-10397

Vulnrichment

Updated: 2024-11-19T15:46:37.602Z

NVD

Status : Awaiting Analysis

Published: 2024-11-14T20:15:21.057

Modified: 2024-11-21T17:15:09.860

Link: CVE-2024-10397

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-10397", "assignerOrgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5", "state": "PUBLISHED", "assignerShortName": "fedora", "dateReserved": "2024-10-25T19:25:51.800Z", "datePublished": "2024-11-14T19:33:15.462Z", "dateUpdated": "2024-11-21T16:10:11.231Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5", "shortName": "fedora", "dateUpdated": "2024-11-14T19:33:15.462Z"}, "datePublic": "2024-11-12T03:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write", "type": "CWE"}]}], "affected": [{"vendor": "OpenAFS", "product": "OpenAFS", "versions": [{"status": "affected", "version": "1.0", "lessThanOrEqual": "1.6.24", "versionType": "custom"}, {"status": "affected", "version": "1.8.0", "lessThanOrEqual": "1.8.12.2", "versionType": "custom"}, {"status": "affected", "version": "1.9.0", "lessThanOrEqual": "1.9.1", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "A malicious server can crash the OpenAFS cache manager and other client\nutilities, and possibly execute arbitrary code.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<pre>A malicious server can crash the OpenAFS cache manager and other client\nutilities, and possibly execute arbitrary code.</pre><br>"}]}], "references": [{"url": "https://openafs.org/pages/security/OPENAFS-SA-2024-003.txt"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"version": "4.0", "attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "baseSeverity": "HIGH", "baseScore": 7.7, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-11-19T15:46:42.562778Z", "id": "CVE-2024-10397", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-21T16:10:11.231Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-10397", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-11-19T15:46:42.562778Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-19T15:46:37.602Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "OpenAFS", "product": "OpenAFS", "versions": [{"status": "affected", "version": "1.0", "versionType": "custom", "lessThanOrEqual": "1.6.24"}, {"status": "affected", "version": "1.8.0", "versionType": "custom", "lessThanOrEqual": "1.8.12.2"}, {"status": "affected", "version": "1.9.0", "versionType": "custom", "lessThanOrEqual": "1.9.1"}], "defaultStatus": "unaffected"}], "datePublic": "2024-11-12T03:00:00.000Z", "references": [{"url": "https://openafs.org/pages/security/OPENAFS-SA-2024-003.txt"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A malicious server can crash the OpenAFS cache manager and other client\nutilities, and possibly execute arbitrary code.", "supportingMedia": [{"type": "text/html", "value": "<pre>A malicious server can crash the OpenAFS cache manager and other client\nutilities, and possibly execute arbitrary code.</pre><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5", "shortName": "fedora", "dateUpdated": "2024-11-14T19:33:15.462Z"}}}, "cveMetadata": {"cveId": "CVE-2024-10397", "state": "PUBLISHED", "dateUpdated": "2024-11-21T16:10:11.231Z", "dateReserved": "2024-10-25T19:25:51.800Z", "assignerOrgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5", "datePublished": "2024-11-14T19:33:15.462Z", "assignerShortName": "fedora"}, "dataVersion": "5.1"}

{"descriptions": [{"lang": "en", "value": "A malicious server can crash the OpenAFS cache manager and other client\nutilities, and possibly execute arbitrary code."}, {"lang": "es", "value": "Un servidor malintencionado puede bloquear el administrador de cach\u00e9 OpenAFS y otras utilidades del cliente y posiblemente ejecutar c\u00f3digo arbitrario."}], "id": "CVE-2024-10397", "lastModified": "2024-11-21T17:15:09.860", "metrics": {"cvssMetricV40": [{"cvssData": {"attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "automatable": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityRequirements": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "recovery": "NOT_DEFINED", "safety": "NOT_DEFINED", "subsequentSystemAvailability": "NONE", "subsequentSystemConfidentiality": "NONE", "subsequentSystemIntegrity": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnerabilityResponseEffort": "NOT_DEFINED", "vulnerableSystemAvailability": "HIGH", "vulnerableSystemConfidentiality": "HIGH", "vulnerableSystemIntegrity": "HIGH"}, "source": "patrick@puiterwijk.org", "type": "Secondary"}]}, "published": "2024-11-14T20:15:21.057", "references": [{"source": "patrick@puiterwijk.org", "url": "https://openafs.org/pages/security/OPENAFS-SA-2024-003.txt"}], "sourceIdentifier": "patrick@puiterwijk.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "patrick@puiterwijk.org", "type": "Secondary"}]}