Debian: DSA-4302-1: openafs security update

    Date 23 Sep 2018
    4625
    Posted By Anthony Pell
    Several vulnerabilities were discovered in openafs, an implementation of the distributed filesystem AFS. The Common Vulnerabilities and Exposures project identifies the following problems:
    
    - -------------------------------------------------------------------------
    Debian Security Advisory DSA-4302-1                   This email address is being protected from spambots. You need JavaScript enabled to view it.
    https://www.debian.org/security/                     Salvatore Bonaccorso
    September 23, 2018                    https://www.debian.org/security/faq
    - -------------------------------------------------------------------------
    
    Package        : openafs
    CVE ID         : CVE-2018-16947 CVE-2018-16948 CVE-2018-16949
    Debian Bug     : 908616
    
    Several vulnerabilities were discovered in openafs, an implementation of
    the distributed filesystem AFS. The Common Vulnerabilities and Exposures
    project identifies the following problems:
    
    CVE-2018-16947
    
        Jeffrey Altman reported that the backup tape controller (butc)
        process does accept incoming RPCs but does not require (or allow
        for) authentication of those RPCs, allowing an unauthenticated
        attacker to perform volume operations with administrator
        credentials.
    
        https://openafs.org/pages/security/OPENAFS-SA-2018-001.txt
    
    CVE-2018-16948
    
        Mark Vitale reported that several RPC server routines do not fully
        initialize output variables, leaking memory contents (from both
        the stack and the heap) to the remote caller for
        otherwise-successful RPCs.
    
        https://openafs.org/pages/security/OPENAFS-SA-2018-002.txt
    
    CVE-2018-16949
    
        Mark Vitale reported that an unauthenticated attacker can consume
        large amounts of server memory and network bandwidth via
        specially crafted requests, resulting in denial of service to
        legitimate clients.
    
        https://openafs.org/pages/security/OPENAFS-SA-2018-003.txt
    
    For the stable distribution (stretch), these problems have been fixed in
    version 1.6.20-2+deb9u2.
    
    We recommend that you upgrade your openafs packages.
    
    For the detailed security status of openafs please refer to its security
    tracker page at:
    https://security-tracker.debian.org/tracker/openafs
    
    Further information about Debian Security Advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://www.debian.org/security/
    
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    

    LinuxSecurity Poll

    Are you considering making the switch to Purism's new Librem 14 Linux laptop to improve your security and privacy online?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/31-are-you-considering-making-the-switch-to-purism-s-new-librem-14-linux-laptop-to-improve-your-security-and-privacy-online?task=poll.vote&format=json
    31
    radio
    [{"id":"109","title":"Yes - the hardware kill switches and default ad blocking\/tracking protection sold me on it.","votes":"3","type":"x","order":"1","pct":37.5,"resources":[]},{"id":"110","title":"Not sure yet - I need to do more research.","votes":"4","type":"x","order":"2","pct":50,"resources":[]},{"id":"111","title":"No - I'm satisfied with my current laptop and have no security\/privacy concerns.","votes":"1","type":"x","order":"3","pct":12.5,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
    bottom 200

    Advisories

    Please enable / Bitte aktiviere JavaScript!
    Veuillez activer / Por favor activa el Javascript![ ? ]

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.