Debian: DSA-4302-1: openafs security update

    Date23 Sep 2018
    CategoryDebian
    4454
    Posted ByAnthony Pell
    Several vulnerabilities were discovered in openafs, an implementation of the distributed filesystem AFS. The Common Vulnerabilities and Exposures project identifies the following problems:
    
    - -------------------------------------------------------------------------
    Debian Security Advisory DSA-4302-1                   This email address is being protected from spambots. You need JavaScript enabled to view it.
    https://www.debian.org/security/                     Salvatore Bonaccorso
    September 23, 2018                    https://www.debian.org/security/faq
    - -------------------------------------------------------------------------
    
    Package        : openafs
    CVE ID         : CVE-2018-16947 CVE-2018-16948 CVE-2018-16949
    Debian Bug     : 908616
    
    Several vulnerabilities were discovered in openafs, an implementation of
    the distributed filesystem AFS. The Common Vulnerabilities and Exposures
    project identifies the following problems:
    
    CVE-2018-16947
    
        Jeffrey Altman reported that the backup tape controller (butc)
        process does accept incoming RPCs but does not require (or allow
        for) authentication of those RPCs, allowing an unauthenticated
        attacker to perform volume operations with administrator
        credentials.
    
        https://openafs.org/pages/security/OPENAFS-SA-2018-001.txt
    
    CVE-2018-16948
    
        Mark Vitale reported that several RPC server routines do not fully
        initialize output variables, leaking memory contents (from both
        the stack and the heap) to the remote caller for
        otherwise-successful RPCs.
    
        https://openafs.org/pages/security/OPENAFS-SA-2018-002.txt
    
    CVE-2018-16949
    
        Mark Vitale reported that an unauthenticated attacker can consume
        large amounts of server memory and network bandwidth via
        specially crafted requests, resulting in denial of service to
        legitimate clients.
    
        https://openafs.org/pages/security/OPENAFS-SA-2018-003.txt
    
    For the stable distribution (stretch), these problems have been fixed in
    version 1.6.20-2+deb9u2.
    
    We recommend that you upgrade your openafs packages.
    
    For the detailed security status of openafs please refer to its security
    tracker page at:
    https://security-tracker.debian.org/tracker/openafs
    
    Further information about Debian Security Advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://www.debian.org/security/
    
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"13","type":"x","order":"1","pct":52,"resources":[]},{"id":"88","title":"Should be more technical","votes":"4","type":"x","order":"2","pct":16,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"8","type":"x","order":"3","pct":32,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.