Detections
Analytics

Debian DLA-342-1 : openafs security update

medium Nessus Plugin ID 86920

Language:

Synopsis

The remote Debian host is missing a security update.

Description

Several vulnerabilities have been found and solved in the distributed file system OpenAFS :

CVE-2015-3282

vos leaked stack data clear on the wire when updating vldb entries.

CVE-2015-3283

OpenAFS allowed remote attackers to spoof bos commands via unspecified vectors.

CVE-2015-3285

pioctl wrongly used the pointer related to the RPC, allowing local users to cause a denial of service (memory corruption and kernel panic) via a crafted OSD FS command.

CVE-2015-6587

vlserver allowed remote authenticated users to cause a denial of service (out-of-bounds read and crash) via a crafted regular expression in a VL_ListAttributesN2 RPC.

CVE-2015-7762 and CVE-2015-7763 ('Tattletale')

John Stumpo found that Rx ACK packets leaked plaintext of packets previously processed.

For Debian 6 'Squeeze', these problems have been fixed in openafs version 1.4.12.1+dfsg-4+squeeze4.

We recommend that you upgrade your OpenAFS packages.

Learn more about the Debian Long Term Support (LTS) Project and how to apply these updates at: https://wiki.debian.org/LTS/

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

Upgrade the affected packages.

See Also

https://lists.debian.org/debian-lts-announce/2015/11/msg00004.html

https://packages.debian.org/source/squeeze-lts/openafs

https://wiki.debian.org/LTS/

Plugin Details

Severity: Medium

ID: 86920

File Name: debian_DLA-342.nasl

Version: 2.6

Type: local

Agent: unix

Published: 11/19/2015

Updated: 1/11/2021

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:libopenafs-dev, p-cpe:/a:debian:debian_linux:libpam-openafs-kaserver, p-cpe:/a:debian:debian_linux:openafs-client, p-cpe:/a:debian:debian_linux:openafs-dbg, p-cpe:/a:debian:debian_linux:openafs-dbserver, p-cpe:/a:debian:debian_linux:openafs-doc, p-cpe:/a:debian:debian_linux:openafs-fileserver, p-cpe:/a:debian:debian_linux:openafs-kpasswd, p-cpe:/a:debian:debian_linux:openafs-krb5, p-cpe:/a:debian:debian_linux:openafs-modules-dkms, p-cpe:/a:debian:debian_linux:openafs-modules-source, cpe:/o:debian:debian_linux:6.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Ease: No known exploits are available

Patch Publication Date: 11/18/2015

Reference Information

CVE: CVE-2015-3282, CVE-2015-3283, CVE-2015-3285, CVE-2015-6587, CVE-2015-7762, CVE-2015-7763