{"id":"CVE-2018-16947","aliases":["DEBIAN-CVE-2018-16947","DLA-1513-1","DSA-4302-1","EUVD-2018-8735","GHSA-67mr-rvh8-9qx2","MGASA-2019-0021","UBUNTU-CVE-2018-16947","openSUSE-SU-2024:11113-1"],"status":"published","title":"An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. The backup tape...","description":"An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. The backup tape controller (butc) process accepts incoming RPCs but does not require (or allow for) authentication of those RPCs. Handling those RPCs results in operations being performed with administrator credentials, including dumping/restoring volume contents and manipulating the backup database. For example, an unauthenticated attacker can replace any volume's content with arbitrary data.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02598,"percentile":0.85456,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287"],"published":"2018-09-12T01:00:00Z","modified":"2026-10-23T18:03:28Z","fixes":[{"ecosystem":"Debian:12","package":"openafs","fixed_in":["1.8.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openafs","fixed_in":["1.8.2-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"openafs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"openafs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"openafs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.9-2+deb8u8"}]}],"versions":["1.6.9-2+deb8u2","1.6.9-2+deb8u3","1.6.9-2+deb8u4","1.6.9-2+deb8u4~bpo70+1","1.6.9-2+deb8u5","1.6.9-2+deb8u6","1.6.9-2+deb8u7"],"bundled":3},{"source":"osv","ecosystem":"Debian:9","package":"openafs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.20-2+deb9u2"}]}],"versions":["1.6.20-2","1.6.20-2+deb9u1"],"bundled":3},{"source":"osv","ecosystem":"Mageia:6","package":"openafs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.23-1.mga6"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"openafs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.14-1","1.6.15-1","1.6.15-1ubuntu1","1.6.15-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"openafs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.21-3","1.6.21-3ubuntu1","1.6.22-3","1.8.0~pre4-1","1.8.0~pre5-1","1.8.0~pre5-1ubuntu1","1.8.0~pre5-1ubuntu1.1","1.8.0~pre5-1ubuntu1.2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"openafs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.8-1.13"}]}],"bundled":3}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"openafs","product":"openafs"}],"references":[{"url":"http://openafs.org/pages/security/OPENAFS-SA-2018-001.txt","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00024.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2018/dsa-4302","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-16947"},{"url":"https://github.com/advisories/GHSA-67mr-rvh8-9qx2"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-16947","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0021.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23663","tags":["report"]},{"url":"https://openafs.org/pages/security/OPENAFS-SA-2018-001.txt","tags":["web"]},{"url":"https://openafs.org/pages/security/OPENAFS-SA-2018-002.txt","tags":["web"]},{"url":"https://openafs.org/pages/security/OPENAFS-SA-2018-003.txt","tags":["web"]},{"url":"http://openafs.org/dl/openafs/1.6.23/RELNOTES-1.6.23","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-16947","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-16947","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16949","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-16947","description":"An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. The backup tape controller (butc) process accepts incoming RPCs but does not require (or allow for) authentication of those RPCs. Handling those RPCs results in operations being performed with administrator credentials, including dumping/restoring volume contents and manipulating the backup database. For example, an unauthenticated attacker can replace any volume's content with arbitrary data.","status":"published","published":"2018-09-12T01:00:00Z","modified":"2024-08-05T10:39:58.033Z","updated_at":"2026-11-02T14:35:11.426178Z"}],"euvd":[{"id":"EUVD-2018-8735","description":"An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. The backup tape controller (butc) process accepts incoming RPCs but does not require (or allow for) authentication of those RPCs. Handling those RPCs results in operations being performed with administrator credentials, including dumping/restoring volume contents and manipulating the backup database. For example, an unauthenticated attacker can replace any volume's content with arbitrary data.","status":"published","published":"2018-09-12T01:00:00Z","modified":"2024-08-05T10:39:58Z","updated_at":"2026-11-03T02:39:39.763591Z"}],"ghsa":[{"id":"GHSA-67mr-rvh8-9qx2","title":"An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. The backup tape...","description":"An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. The backup tape controller (butc) process accepts incoming RPCs but does not require (or allow for) authentication of those RPCs. Handling those RPCs results in operations being performed with administrator credentials, including dumping/restoring volume contents and manipulating the backup database. For example, an unauthenticated attacker can replace any volume's content with arbitrary data.","status":"published","published":"2022-05-13T01:50:28Z","modified":"2023-02-02T05:02:01Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:51:19.670124Z"}],"nvd":[{"id":"CVE-2018-16947","description":"An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. The backup tape controller (butc) process accepts incoming RPCs but does not require (or allow for) authentication of those RPCs. Handling those RPCs results in operations being performed with administrator credentials, including dumping/restoring volume contents and manipulating the backup database. For example, an unauthenticated attacker can replace any volume's content with arbitrary data.","status":"published","published":"2018-09-12T01:29:00.39Z","modified":"2026-06-17T01:45:06.05Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:04:38.672108Z"}],"osv":[{"id":"CVE-2018-16947","description":"An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. The backup tape controller (butc) process accepts incoming RPCs but does not require (or allow for) authentication of those RPCs. Handling those RPCs results in operations being performed with administrator credentials, including dumping/restoring volume contents and manipulating the backup database. For example, an unauthenticated attacker can replace any volume's content with arbitrary data.","status":"published","published":"2018-09-12T01:29:00.39Z","modified":"2026-04-16T06:19:35.534889401Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:08.533609Z"},{"id":"DEBIAN-CVE-2018-16947","description":"An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. The backup tape controller (butc) process accepts incoming RPCs but does not require (or allow for) authentication of those RPCs. Handling those RPCs results in operations being performed with administrator credentials, including dumping/restoring volume contents and manipulating the backup database. For example, an unauthenticated attacker can replace any volume's content with arbitrary data.","status":"published","published":"2018-09-12T01:29:00.39Z","modified":"2026-10-23T18:03:28.64827139Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:30.57382Z"},{"id":"UBUNTU-CVE-2018-16947","description":"An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. The backup tape controller (butc) process accepts incoming RPCs but does not require (or allow for) authentication of those RPCs. Handling those RPCs results in operations being performed with administrator credentials, including dumping/restoring volume contents and manipulating the backup database. For example, an unauthenticated attacker can replace any volume's content with arbitrary data.","status":"published","published":"2018-09-12T01:29:00Z","modified":"2026-04-22T11:48:12.683416Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:17.496046Z"},{"id":"DLA-1513-1","title":"openafs - security update","status":"published","published":"2018-09-21T00:00:00Z","modified":"2026-03-09T01:19:22.984385Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DSA-4302-1","title":"openafs - security update","status":"published","published":"2018-09-23T00:00:00Z","modified":"2026-03-09T02:10:12.724144Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"MGASA-2019-0021","title":"Updated openafs packages fix security vulnerabilities","description":"Jeffrey Altman reported that the backup tape controller (butc) process\ndoes accept incoming RPCs but does not require (or allow for)\nauthentication of those RPCs, allowing an unauthenticated attacker to\nperform volume operations with administrator credentials\n(CVE-2018-16947).\n\nMark Vitale reported that several RPC server routines do not fully\ninitialize output variables, leaking memory contents (from both the\nstack and the heap) to the remote caller for otherwise-successful RPCs\n(CVE-2018-16948).\n\nMark Vitale reported that an unauthenticated attacker can consume large\namounts of server memory and network bandwidth via specially crafted\nrequests, resulting in denial of service to legitimate clients\n(CVE-2018-16949).\n","status":"published","published":"2019-01-08T21:50:23Z","modified":"2026-04-16T06:25:47.436540473Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2024:11113-1","title":"openafs-1.8.8-1.13 on GA media","description":"These are all security issues fixed in the openafs-1.8.8-1.13 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:15:45.00846Z","updated_at":"2026-11-02T16:58:34.894275Z"}]}}