CVE-2016-4536

{"id": "CVE-2016-4536", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2016-05-13T16:59:11.920", "references": [{"url": "https://lists.openafs.org/pipermail/openafs-announce/2016/000496.html", "tags": ["Vendor Advisory"], "source": "security@debian.org"}, {"url": "https://www.openafs.org/dl/openafs/1.6.17/RELNOTES-1.6.17", "tags": ["Vendor Advisory"], "source": "security@debian.org"}, {"url": "https://www.openafs.org/pages/security/OPENAFS-SA-2016-002.txt", "tags": ["Vendor Advisory"], "source": "security@debian.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "The client in OpenAFS before 1.6.17 does not properly initialize the (1) AFSStoreStatus, (2) AFSStoreVolumeStatus, (3) VldbListByAttributes, and (4) ListAddrByAttributes structures, which might allow remote attackers to obtain sensitive memory information by leveraging access to RPC call traffic."}, {"lang": "es", "value": "El cliente en OpenAFS en versiones anteriores a 1.6.17 no inicializa adecuadamente las estructuras (1) AFSStoreStatus, (2) AFSStoreVolumeStatus, (3) VldbListByAttributes y (4) ListAddrByAttributes, lo que podr\u00eda permitir a atacantes remotos obtener informaci\u00f3n de memoria sensible aprovechando el acceso al tr\u00e1fico de llamadas RPC."}], "lastModified": "2016-05-19T13:40:27.307", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openafs:openafs:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A5F1B642-7864-4117-B88C-70331F00BD16", "versionEndIncluding": "1.6.16"}], "operator": "OR"}]}], "sourceIdentifier": "security@debian.org"}