Off-by-one error in afs_pioctl.c in OpenAFS before 1.6.16 might allow local users to cause a denial of service (memory overwrite and system crash) via a pioctl with an input buffer size of 4096 bytes.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Off-by-one error in afs_pioctl.c in OpenAFS before 1.6.16 might allow local users to cause a denial of     service (memory overwrite and system crash) via a pioctl with an input buffer size of 4096 bytes.
    (CVE-2015-8312)

Note that Nessus relies on the presence of the package as reported by the vendor.

The OpenAFS development team reports :

Avoid a potential denial of service issue, by fixing a bug in pioctl logic that allowed a local user to overrun a kernel buffer with a single NUL byte.

- CVE-2015-8312: Off-by-one error in afs_pioctl.c in     OpenAFS before 1.6.16 might allow local users to cause a     denial of service (memory overwrite and system crash)     via a pioctl with an input buffer size of 4096 bytes.

  - CVE-2016-2860: The newEntry function in     ptserver/ptprocs.c in OpenAFS before 1.6.17 allows     remote authenticated users from foreign Kerberos realms     to bypass intended access restrictions and create     arbitrary groups as administrators by leveraging     mishandling of the creator ID.

  - CVE-2016-4536: The client in OpenAFS before 1.6.17 does     not properly initialize the (1) AFSStoreStatus, (2)     AFSStoreVolumeStatus, (3) VldbListByAttributes, and (4)     ListAddrByAttributes structures, which might allow     remote attackers to obtain sensitive memory information     by leveraging access to RPC call traffic.

For Debian 7 'Wheezy', these problems have been fixed in version 1.6.1-3+deb7u6.

We recommend that you upgrade your openafs packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Two vulnerabilities were discovered in openafs, an implementation of the distributed filesystem AFS. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2015-8312     Potential denial of service caused by a bug in the     pioctl logic allowing a local user to overrun a kernel     buffer with a single NUL byte.

  - CVE-2016-2860     Peter Iannucci discovered that users from foreign     Kerberos realms can create groups as if they were     administrators.

ID	Name	Product	Family	Severity
254743	Linux Distros Unpatched Vulnerability : CVE-2015-8312	Nessus	Misc.	high
91476	FreeBSD : openafs -- local DoS vulnerability (2e8fe57e-2b46-11e6-ae88-002590263bf5)	Nessus	FreeBSD Local Security Checks	high
91360	Debian DLA-493-1 : openafs security update	Nessus	Debian Local Security Checks	high
90928	Debian DSA-3569-1 : openafs - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2015-8312

high

Tenable Plugins

high

high

high

high