CVE-2016-2860
The newEntry function in ptserver/ptprocs.c in OpenAFS before 1.6.17 allows remote authenticated...
CVE-2016-2860 is a medium vulnerability (CVSS 6.5) in Openafs, published March 25, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.50%, the 74th percentile. Fixed in openafs 1.6.17-1.
The newEntry function in ptserver/ptprocs.c in OpenAFS before 1.6.17 allows remote authenticated users from foreign Kerberos realms to bypass intended access restrictions and create arbitrary groups as administrators by leveraging mishandling of the creator ID.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The newEntry function in ptserver/ptprocs.c in OpenAFS before 1.6.17 allows remote authenticated users from foreign Kerberos realms to bypass intended access restrictions and create arbitrary groups as administrators by leveraging mishandling of the creator ID.
- Record
CVE-2016-2860- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:N/I:P/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
CVE List No score
The newEntry function in ptserver/ptprocs.c in OpenAFS before 1.6.17 allows remote authenticated users from foreign Kerberos realms to bypass intended access restrictions and create arbitrary groups as administrators by leveraging mishandling of the creator ID.
- Record
CVE-2016-2860- Updated
- 2026-11-02
EUVDEUVD-2016-3933 No score
The newEntry function in ptserver/ptprocs.c in OpenAFS before 1.6.17 allows remote authenticated users from foreign Kerberos realms to bypass intended access restrictions and create arbitrary groups as administrators by leveraging mishandling of the creator ID.
- Record
EUVD-2016-3933- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fxfw-fpvf-77hw
The newEntry function in ptserver/ptprocs.c in OpenAFS before 1.6.17 allows remote authenticated...
The newEntry function in ptserver/ptprocs.c in OpenAFS before 1.6.17 allows remote authenticated users from foreign Kerberos realms to bypass intended access restrictions and create arbitrary groups as administrators by leveraging mishandling of the creator ID.
- Record
GHSA-fxfw-fpvf-77hw- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSV
The newEntry function in ptserver/ptprocs.c in OpenAFS before 1.6.17 allows remote authenticated users from foreign Kerberos realms to bypass intended access restrictions and create arbitrary groups as administrators by leveraging mishandling of the creator ID.
- Record
CVE-2016-2860- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-2860
The newEntry function in ptserver/ptprocs.c in OpenAFS before 1.6.17 allows remote authenticated users from foreign Kerberos realms to bypass intended access restrictions and create arbitrary groups as administrators by leveraging mishandling of the creator ID.
- Record
DEBIAN-CVE-2016-2860- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-2860
The newEntry function in ptserver/ptprocs.c in OpenAFS before 1.6.17 allows remote authenticated users from foreign Kerberos realms to bypass intended access restrictions and create arbitrary groups as administrators by leveraging mishandling of the creator ID.
- Record
UBUNTU-CVE-2016-2860- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVMGASA-2016-0121 No score
Updated openafs packages fix security vulnerability
In OpenAFS before 1.6.17, users from foreign Kerberos realms can create groups as if they were administrators (CVE-2016-2860).
In OpenAFS before 1.6.17, information leakage over the network due to uninitialized memory (CVE-2016-4536).
- Record
MGASA-2016-0121- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openafsDebian:12 |
before 1.6.17-1 | 1.6.17-1 |
openafsDebian:13 |
before 1.6.17-1 | 1.6.17-1 |
openafsDebian:7 |
before 1.6.1-3+deb7u6, plus listed versions 1.6.1-31.6.1-3+deb7u11.6.1-3+deb7u1~bpo60+11.6.1-3+deb7u21.6.1-3+deb7u2~bpo60+11.6.1-3+deb7u31.6.1-3+deb7u41.6.1-3+deb7u5 |
1.6.1-3+deb7u6 |
openafsDebian:8 |
before 1.6.9-2+deb8u5, plus listed versions 1.6.9-2+deb8u21.6.9-2+deb8u31.6.9-2+deb8u41.6.9-2+deb8u4~bpo70+1 |
1.6.9-2+deb8u5 |
openafsMageia:5 |
before 1.6.17-1.mga5 | 1.6.17-1.mga5 |
openafsUbuntu:16.04:LTS |
All versions, plus listed versions 1.6.14-11.6.15-11.6.15-1ubuntu11.6.15-1ubuntu1.1 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
openafs.org/pages/security/OPENAFS-SA-2016-001.txt
debian.org/security/2016/dsa-3569
git.openafs.org?p=openafs.git%3Ba=commitdiff%3Bh=396240cf070a806b91fea81131d034e1399af1e0
lists.openafs.org/pipermail/openafs-announce/2016/000496.html
nvd.nist.gov/vuln/detail/CVE-2016-2860
Show 12 moreShow less
github.com/advisories/GHSA-fxfw-fpvf-77hw
security-tracker.debian.org/tracker/CVE-2016-2860
advisories.mageia.org/MGASA-2016-0121.html
bugs.mageia.org/show_bug.cgi?id=18034
dl.openafs.org/dl/1.6.16/RELNOTES-1.6.16
openwall.com/lists/oss-security/2016/05/05/23
ubuntu.com/security/CVE-2016-2860
cve.org/CVERecord?id=CVE-2016-2860