Description
The default configuration in OpenAFS 1.4.x before 1.4.4 and 1.5.x before 1.5.17 supports setuid programs within the local cell, which might allow attackers to gain privileges by spoofing a response to an AFS cache manager FetchStatus request, and setting setuid and root ownership for files in the cache.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | openafs | 1.4.2-6 | — |
| Debian 12 | openafs | 1.4.2-6 | — |
| Debian 3.1 | openafs | 1.3.81-3sarge2 | DSA-1271-1 |
Advisories 1
- DSA-1271-1 openafs - design error Debian Security (DSA / DLA) · Mar 9, 2026
References
- ADV-2007-1033 vdb-entry
- 24582 third-party-advisory
- 1017807 vdb-entry
- [OpenAFS-announce] 20070319 OpenAFS 1.5.17 release available mailing-list
- openafs-setuid-privilege-escalation(33180) vdb-entry
- DSA-1271 vendor-advisory
- 24720 third-party-advisory
- [OpenAFS-announce] 20070319 OpenAFS 1.4.4 available mailing-list
- 24607 third-party-advisory
- GLSA-200704-03 vendor-advisory
- [OpenAFS-announce] 20070320 OpenAFS Security Advisory 2007-001: privilege escalation in Unix-based clients mailing-list
- MDKSA-2007:066 vendor-advisory
- 24599 third-party-advisory
- 23060 vdb-entry