bugtraq - [ MDKSA-2007:066 ] - Updated OpenAFS packages address vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 20 Mar 2007 18:12:48 -0600
From: security@...driva.com
To: bugtraq@...urityfocus.com
Subject: [ MDKSA-2007:066 ] - Updated OpenAFS packages address vulnerability


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________
 
 Mandriva Linux Security Advisory                         MDKSA-2007:066
 http://www.mandriva.com/security/
 _______________________________________________________________________
 
 Package : openafs
 Date    : March 20, 2007
 Affected: 2007.0
 _______________________________________________________________________
 
 Problem Description:
 
 By default, OpenAFS prior to 1.44 and 1.5.17 supports setuid programs
 within the local cell, which could allow attackers to obtain privileges.
 
 Updated packages have been patched to address this issue.
 _______________________________________________________________________

 References:
 
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1507
 _______________________________________________________________________
 
 Updated Packages:
 
 Mandriva Linux 2007.0:
 5f245149a0f7d9c654811a8100ac4c99  2007.0/i586/dkms-libafs-1.4.1-5.1mdv2007.0.i586.rpm
 e95bfb0a96395b0bf76779928e809fb6  2007.0/i586/libopenafs1-1.4.1-5.1mdv2007.0.i586.rpm
 f9823ac9d6335867ea5e7db6297f76c3  2007.0/i586/libopenafs1-devel-1.4.1-5.1mdv2007.0.i586.rpm
 513203c9f79e10d45a428947b3968671  2007.0/i586/openafs-1.4.1-5.1mdv2007.0.i586.rpm
 fefbc3291e162c2271b252c561ec4ac8  2007.0/i586/openafs-client-1.4.1-5.1mdv2007.0.i586.rpm
 712c5a6b3d033e68a1dcec75b89d4991  2007.0/i586/openafs-doc-1.4.1-5.1mdv2007.0.i586.rpm
 34de4c3b5ca22e8ca8e9d76cbf5c4d70  2007.0/i586/openafs-server-1.4.1-5.1mdv2007.0.i586.rpm 
 389e28512334f66a0d44c8cf3878c7bb  2007.0/SRPMS/openafs-1.4.1-5.1mdv2007.0.src.rpm

 Mandriva Linux 2007.0/X86_64:
 528117bf510ff2c31690d82817794c97  2007.0/x86_64/dkms-libafs-1.4.1-5.1mdv2007.0.x86_64.rpm
 e6e5804b57822d0be27e1340383f82ae  2007.0/x86_64/lib64openafs1-1.4.1-5.1mdv2007.0.x86_64.rpm
 3fe146dc10eba896fb96c30ed3343452  2007.0/x86_64/lib64openafs1-devel-1.4.1-5.1mdv2007.0.x86_64.rpm
 b4da48079d79eed91dc709247cf1feeb  2007.0/x86_64/openafs-1.4.1-5.1mdv2007.0.x86_64.rpm
 e6b6ed613f90960c2b231eee920ec92a  2007.0/x86_64/openafs-client-1.4.1-5.1mdv2007.0.x86_64.rpm
 b3721d7cef3df8173b89c422687a85ff  2007.0/x86_64/openafs-doc-1.4.1-5.1mdv2007.0.x86_64.rpm
 58b999c155164afe426cd6cc76e93e06  2007.0/x86_64/openafs-server-1.4.1-5.1mdv2007.0.x86_64.rpm 
 389e28512334f66a0d44c8cf3878c7bb  2007.0/SRPMS/openafs-1.4.1-5.1mdv2007.0.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)

iD8DBQFGAE48mqjQ0CJFipgRAtjGAKCHL8YwKgqLVP10p/SVzNILA4qllgCgp6MB
MD5PxxM8FqQ6W2S9zpUn6O4=
=Sz3I
-----END PGP SIGNATURE-----