Security Advisory
CVE-2016-2860
CVE vulnerability detail — eXtreme Datacenter Security Operations
Description
The newEntry function in ptserver/ptprocs.c in OpenAFS before 1.6.17 allows remote authenticated users from foreign Kerberos realms to bypass intended access restrictions and create arbitrary groups as administrators by leveraging mishandling of the creator ID.