CVE-2009-1250
The cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58, and IBM...
The cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58, and IBM AFS 3.6 before Patch 19, on Linux allows remote attackers to cause a denial of service (system crash) via an RX response with a large error-code value that is interpreted as a pointer and dereferenced, related to use of the ERR_PTR macro.
Exploit likelihood
What each source reports
NVD Score used
The cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58, and IBM AFS 3.6 before Patch 19, on Linux allows remote attackers to cause a denial of service (system crash) via an RX response with a large error-code value that is interpreted as a pointer and dereferenced, related to use of the ERR_PTR macro.
- Record
CVE-2009-1250- CVSS 2.0
- 7.8 High
AV:N/AC:L/Au:N/C:N/I:N/A:C - Weakness
- CWE-189
- Updated
- 2026-11-02
CVE List No score
The cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58, and IBM AFS 3.6 before Patch 19, on Linux allows remote attackers to cause a denial of service (system crash) via an RX response with a large error-code value that is interpreted as a pointer and dereferenced, related to use of the ERR_PTR macro.
- Record
CVE-2009-1250- Updated
- 2026-11-02
EUVDEUVD-2009-1249 No score
The cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58, and IBM AFS 3.6 before Patch 19, on Linux allows remote attackers to cause a denial of service (system crash) via an RX response with a large error-code value that is interpreted as a pointer and dereferenced, related to use of the ERR_PTR macro.
- Record
EUVD-2009-1249- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cpqp-v482-xxhg No score
The cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58, and IBM...
The cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58, and IBM AFS 3.6 before Patch 19, on Linux allows remote attackers to cause a denial of service (system crash) via an RX response with a large error-code value that is interpreted as a pointer and dereferenced, related to use of the ERR_PTR macro.
- Record
GHSA-cpqp-v482-xxhg- Updated
- 2026-11-02
OSV No score
The cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58, and IBM AFS 3.6 before Patch 19, on Linux allows remote attackers to cause a denial of service (system crash) via an RX response with a large error-code value that is interpreted as a pointer and dereferenced, related to use of the ERR_PTR macro.
- Record
CVE-2009-1250- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-1250 No score
The cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58, and IBM AFS 3.6 before Patch 19, on Linux allows remote attackers to cause a denial of service (system crash) via an RX response with a large error-code value that is interpreted as a pointer and dereferenced, related to use of the ERR_PTR macro.
- Record
DEBIAN-CVE-2009-1250- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openafsDebian:12 |
before 1.4.10+dfsg1-1 | 1.4.10+dfsg1-1 |
openafsDebian:13 |
before 1.4.10+dfsg1-1 | 1.4.10+dfsg1-1 |
openafsDebian:4.0 From an advisory covering 2 CVEs |
before 1.4.2-6etch2, plus listed versions 1.4.2-61.4.2-6etch1 |
1.4.2-6etch2 |
openafsDebian:5.0 From an advisory covering 2 CVEs |
before 1.4.7.dfsg1-6+lenny1, plus listed versions 1.4.7.dfsg1-6 |
1.4.7.dfsg1-6+lenny1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-1250 is a high vulnerability (CVSS 7.8) in Ibm Afs, published April 9, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.98%, the 90th percentile. Fixed in openafs 1.4.10+dfsg1-1.
References
vupen.com/english/advisories/2011/0117
openafs.org/security/openafs-sa-2009-002.patch
mandriva.com/security/advisories?name=MDVSA-2009:099
securityfocus.com/bid/34404
Show 11 moreShow less
secunia.com/advisories/36310
debian.org/security/2009/dsa-1768
www-1.ibm.com/support/docview.wss?uid=swg1ID71123
www-01.ibm.com/support/docview.wss?uid=swg21396389
security.gentoo.org/glsa/glsa-201101-05.xml
nvd.nist.gov/vuln/detail/CVE-2009-1250
github.com/advisories/GHSA-cpqp-v482-xxhg
security-tracker.debian.org/tracker/CVE-2009-1250