Read the docs
TI-2009-01186 Aliases CVE-2009-1251GHSA-2xj8-3jr2-7qw3

Heap-based buffer overflow in the cache manager in the client in OpenAFS 1.0 through…

Priority MEDIUM 52CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
Complete · Complete · Complete
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

Heap-based buffer overflow in the cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58 on Unix platforms allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via an RX response containing more data than specified in a request, related to use of XDR arrays.

Why it matters now

EPSS 0.06438 93rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 72

CPEVersionsRoleVendor
cpe:2.3:o:unix:unix:*:*:*:*:*:*:*:*all versionsVulnerableUnix
cpe:2.3:a:openafs:openafs:1.0:*:*:*:*:*:*:*1.0VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.0.1:*:*:*:*:*:*:*1.0.1VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.0.2:*:*:*:*:*:*:*1.0.2VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.0.3:*:*:*:*:*:*:*1.0.3VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.0.4:*:*:*:*:*:*:*1.0.4VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.0.4a:*:*:*:*:*:*:*1.0.4aVulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.1:*:*:*:*:*:*:*1.1VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.1.0:*:*:*:*:*:*:*1.1.0VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.1.1:*:*:*:*:*:*:*1.1.1VulnerableThe OpenAFS Foundation
Show 62 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:openafs:openafs:1.1.1a:*:*:*:*:*:*:*1.1.1aVulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.2:*:*:*:*:*:*:*1.2VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.2.1:*:*:*:*:*:*:*1.2.1VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.2.2:*:*:*:*:*:*:*1.2.2VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.2.2a:*:*:*:*:*:*:*1.2.2aVulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.2.2b:*:*:*:*:*:*:*1.2.2bVulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.2.3:*:*:*:*:*:*:*1.2.3VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.2.4:*:*:*:*:*:*:*1.2.4VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.2.5:*:*:*:*:*:*:*1.2.5VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.2.6:*:*:*:*:*:*:*1.2.6VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.2.7:*:*:*:*:*:*:*1.2.7VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.2.8:*:*:*:*:*:*:*1.2.8VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.2.9:*:*:*:*:*:*:*1.2.9VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.2.10:*:*:*:*:*:*:*1.2.10VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.2.11:*:*:*:*:*:*:*1.2.11VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.2.13:*:*:*:*:*:*:*1.2.13VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.3:*:*:*:*:*:*:*1.3VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.3.1:*:*:*:*:*:*:*1.3.1VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.3.2:*:*:*:*:*:*:*1.3.2VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.3.5:*:*:*:*:*:*:*1.3.5VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.3.70:*:*:*:*:*:*:*1.3.70VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.3.74:*:*:*:*:*:*:*1.3.74VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.3.77:*:*:*:*:*:*:*1.3.77VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.3.81:*:*:*:*:*:*:*1.3.81VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4:*:*:*:*:*:*:*1.4VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4.0:*:*:*:*:*:*:*1.4.0VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4.3:*:*:*:*:*:*:*1.4.3VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4.4:*:*:*:*:*:*:*1.4.4VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4.5:*:*:*:*:*:*:*1.4.5VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4.6:*:*:*:*:*:*:*1.4.6VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4.7:*:*:*:*:*:*:*1.4.7VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4.7_pre1:*:*:*:*:*:*:*1.4.7_pre1VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4.7_pre2:*:*:*:*:*:*:*1.4.7_pre2VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4.7_pre3:*:*:*:*:*:*:*1.4.7_pre3VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4.7_pre4:*:*:*:*:*:*:*1.4.7_pre4VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4.7_pre5:*:*:*:*:*:*:*1.4.7_pre5VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4.8:*:*:*:*:*:*:*1.4.8VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4.8_pre1:*:*:*:*:*:*:*1.4.8_pre1VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4.8_pre2:*:*:*:*:*:*:*1.4.8_pre2VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4.8_pre3:*:*:*:*:*:*:*1.4.8_pre3VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.5:*:*:*:*:*:*:*1.5VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.5.16:*:*:*:*:*:*:*1.5.16VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.5.17:*:*:*:*:*:*:*1.5.17VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.5.26:*:*:*:*:*:*:*1.5.26VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.5.27:*:*:*:*:*:*:*1.5.27VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.5.30:*:*:*:*:*:*:*1.5.30VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.5.31:*:*:*:*:*:*:*1.5.31VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.5.32:*:*:*:*:*:*:*1.5.32VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.5.33:*:*:*:*:*:*:*1.5.33VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.5.34:*:*:*:*:*:*:*1.5.34VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.5.35:*:*:*:*:*:*:*1.5.35VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.5.36:*:*:*:*:*:*:*1.5.36VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.5.38:*:*:*:*:*:*:*1.5.38VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.5.39:*:*:*:*:*:*:*1.5.39VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.5.50:*:*:*:*:*:*:*1.5.50VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.5.52:*:*:*:*:*:*:*1.5.52VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.5.53:*:*:*:*:*:*:*1.5.53VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.5.54:*:*:*:*:*:*:*1.5.54VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.5.55:*:*:*:*:*:*:*1.5.55VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.5.56:*:*:*:*:*:*:*1.5.56VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.5.57:*:*:*:*:*:*:*1.5.57VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.5.58:*:*:*:*:*:*:*1.5.58VulnerableThe OpenAFS Foundation

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2009-1251
  2. 2026-10-03 Alias added: GHSA-2xj8-3jr2-7qw3

References

Sources