bugtraq - [SECURITY] [DSA 4302-1] openafs security update

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Sun, 23 Sep 2018 15:34:19 +0000
From: Salvatore Bonaccorso <carnil@...ian.org>
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA 4302-1] openafs security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4302-1                   security@...ian.org
https://www.debian.org/security/                     Salvatore Bonaccorso
September 23, 2018                    https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : openafs
CVE ID         : CVE-2018-16947 CVE-2018-16948 CVE-2018-16949
Debian Bug     : 908616

Several vulnerabilities were discovered in openafs, an implementation of
the distributed filesystem AFS. The Common Vulnerabilities and Exposures
project identifies the following problems:

CVE-2018-16947

    Jeffrey Altman reported that the backup tape controller (butc)
    process does accept incoming RPCs but does not require (or allow
    for) authentication of those RPCs, allowing an unauthenticated
    attacker to perform volume operations with administrator
    credentials.

    https://openafs.org/pages/security/OPENAFS-SA-2018-001.txt

CVE-2018-16948

    Mark Vitale reported that several RPC server routines do not fully
    initialize output variables, leaking memory contents (from both
    the stack and the heap) to the remote caller for
    otherwise-successful RPCs.

    https://openafs.org/pages/security/OPENAFS-SA-2018-002.txt

CVE-2018-16949

    Mark Vitale reported that an unauthenticated attacker can consume
    large amounts of server memory and network bandwidth via
    specially crafted requests, resulting in denial of service to
    legitimate clients.

    https://openafs.org/pages/security/OPENAFS-SA-2018-003.txt

For the stable distribution (stretch), these problems have been fixed in
version 1.6.20-2+deb9u2.

We recommend that you upgrade your openafs packages.

For the detailed security status of openafs please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/openafs

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@...ts.debian.org
-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlunsg9fFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0Tjyw//WwsLK94ASt5DibQOayv7L4ALd3idR/jgtBZOpyBy4jXceYUgjQX6z+eh
3cdhzDV9N9mzpv592Z/txSeZ+1jptNvIxeYQGGLmxOqRfWxvG7rGUXZEF3wdBcv/
5oajzwRYDiRBz+AygXA4DQVsNe+jAkUdNcclq5W5akI3MOEqTLxO/pR5qu4mK5jK
fF+btPY/VEXKKHsveprS93dR3C4MpXfxsjumeHvYWyNGQmPcdiCB0Eq1vM+PVKJ9
Fp8n1+LuiVwmCUCrR+hdtUsQyLs8p2YACslBf5F2SLpEDSwOyUp9PrgllgH/qIir
m6On0i8vVbg36NZGcUohbYti+WT8O89plJM6Nzk6ToQC8yhhK0bpcPaP2Y8u4MXf
WehmzRewGHfiHPIQEu52ztbrOug5S+KGp645bLR5VjghDS5s1r2PP3MtK16fY4Z/
NQ9Yh8GelpspV1arh6cmf8tU2IHSDwvXrZVVBaAFsupmr1LcKInzSvAbzjxPcsMb
3U3XC5yCZeKogZ7d/9CWHQeu7ljtuBSOYcJnYSeAaxZhUP7YDb/aaGc1frt0M1iu
IGVC+VS7nZ3VGOTd0FFNQVXy+XGkbIWUYtriR+JJtySk9ZFf/va3tWFghlFthaG3
9BHQ76ZIuh2HDMNDn6p95Rv8TZrsT1PxHJsvEWvyhbo4MjmuyMY=
=AKYI
-----END PGP SIGNATURE-----