PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-9772 Openafs CVE debrief

CVE-2016-9772 is an information-disclosure issue in OpenAFS affecting version 1.6.19 and earlier. A remote attacker may be able to learn sensitive directory information from the client cache partition, the fileserver vice partition, or certain RPC responses. NVD rates the issue as medium severity with network access and no user interaction required.

Vendor
Openafs
Product
Unknown
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-06
Original CVE updated
2026-05-13
Advisory published
2017-02-06
Advisory updated
2026-05-13

Who should care

Organizations running OpenAFS clients or fileservers, especially where directory metadata or filesystem layout information is sensitive. Administrators should pay close attention if OpenAFS is exposed in production environments or used to support shared infrastructure.

Technical summary

NVD identifies OpenAFS through 1.6.19 as vulnerable to remote information disclosure. The attack surface includes leakage from the client cache partition, the fileserver vice partition, and certain RPC responses. The published CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates a network-reachable issue with confidentiality impact only, and NVD maps it to CWE-200.

Defensive priority

Medium. Prioritize remediation on systems that expose OpenAFS or rely on directory confidentiality, but this is not a high-severity integrity or availability issue.

Recommended defensive actions

  • Upgrade OpenAFS beyond version 1.6.19 using the vendor guidance in the OpenAFS security advisory.
  • Inventory hosts running OpenAFS clients and fileservers so affected versions can be identified quickly.
  • Review whether exposed directory metadata could reveal sensitive naming, access, or topology information in your environment.
  • If immediate upgrade is not possible, limit network exposure and monitor for unexpected access to OpenAFS-related services and responses.

Evidence notes

The NVD entry states that OpenAFS 1.6.19 and earlier are vulnerable and lists the CVSS v3.0 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N with CWE-200. The vendor advisory and related references point to OpenAFS security advisory OPENAFS-SA-2016-003 and an oss-security mailing list post dated 2016-12-02. These sources support a remote disclosure affecting directory information, without claims about integrity or availability impact.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-9772 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-9772

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-9772 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-9772

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.