Linux Security
    Linux Security
    Linux Security

    Debian: DSA-4302-1: openafs security update

    Date
    4659
    Posted By
    Several vulnerabilities were discovered in openafs, an implementation of the distributed filesystem AFS. The Common Vulnerabilities and Exposures project identifies the following problems:
    
    - -------------------------------------------------------------------------
    Debian Security Advisory DSA-4302-1                   This email address is being protected from spambots. You need JavaScript enabled to view it.
    https://www.debian.org/security/                     Salvatore Bonaccorso
    September 23, 2018                    https://www.debian.org/security/faq
    - -------------------------------------------------------------------------
    
    Package        : openafs
    CVE ID         : CVE-2018-16947 CVE-2018-16948 CVE-2018-16949
    Debian Bug     : 908616
    
    Several vulnerabilities were discovered in openafs, an implementation of
    the distributed filesystem AFS. The Common Vulnerabilities and Exposures
    project identifies the following problems:
    
    CVE-2018-16947
    
        Jeffrey Altman reported that the backup tape controller (butc)
        process does accept incoming RPCs but does not require (or allow
        for) authentication of those RPCs, allowing an unauthenticated
        attacker to perform volume operations with administrator
        credentials.
    
        https://openafs.org/pages/security/OPENAFS-SA-2018-001.txt
    
    CVE-2018-16948
    
        Mark Vitale reported that several RPC server routines do not fully
        initialize output variables, leaking memory contents (from both
        the stack and the heap) to the remote caller for
        otherwise-successful RPCs.
    
        https://openafs.org/pages/security/OPENAFS-SA-2018-002.txt
    
    CVE-2018-16949
    
        Mark Vitale reported that an unauthenticated attacker can consume
        large amounts of server memory and network bandwidth via
        specially crafted requests, resulting in denial of service to
        legitimate clients.
    
        https://openafs.org/pages/security/OPENAFS-SA-2018-003.txt
    
    For the stable distribution (stretch), these problems have been fixed in
    version 1.6.20-2+deb9u2.
    
    We recommend that you upgrade your openafs packages.
    
    For the detailed security status of openafs please refer to its security
    tracker page at:
    https://security-tracker.debian.org/tracker/openafs
    
    Further information about Debian Security Advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://www.debian.org/security/
    
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    

    Advisories

    LinuxSecurity Poll

    Have you ever used tcpdump for network troubleshooting or debugging?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 2 answer(s).
    /main-polls/36-have-you-ever-used-tcpdump-for-network-troubleshooting-or-debugging?task=poll.vote&format=json
    36
    radio
    [{"id":"125","title":"Yes","votes":"43","type":"x","order":"1","pct":82.69,"resources":[]},{"id":"126","title":"No ","votes":"9","type":"x","order":"2","pct":17.31,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350


    VIEW MORE POLLS

    bottom 200

    Please enable / Bitte aktiviere JavaScript!
    Veuillez activer / Por favor activa el Javascript![ ? ]

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.