The client in OpenAFS before 1.6.17 does not properly initialize the (1) AFSStoreStatus, (2) AFSStoreVolumeStatus, (3) VldbListByAttributes, and (4) ListAddrByAttributes structures, which might allow remote attackers to obtain sensitive memory information by leveraging access to RPC call traffic.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The client in OpenAFS before 1.6.17 does not properly initialize the (1) AFSStoreStatus, (2)     AFSStoreVolumeStatus, (3) VldbListByAttributes, and (4) ListAddrByAttributes structures, which might allow     remote attackers to obtain sensitive memory information by leveraging access to RPC call traffic.
    (CVE-2016-4536)

Note that Nessus relies on the presence of the package as reported by the vendor.

The OpenAFS development team reports :

Foreign users can bypass access controls to create groups as system:administrators, including in the user namespace and the system:
namespace.

The contents of uninitialized memory are sent on the wire when clients perform certain RPCs. Depending on the RPC, the information leaked may come from kernel memory or userspace.

- CVE-2015-8312: Off-by-one error in afs_pioctl.c in     OpenAFS before 1.6.16 might allow local users to cause a     denial of service (memory overwrite and system crash)     via a pioctl with an input buffer size of 4096 bytes.

  - CVE-2016-2860: The newEntry function in     ptserver/ptprocs.c in OpenAFS before 1.6.17 allows     remote authenticated users from foreign Kerberos realms     to bypass intended access restrictions and create     arbitrary groups as administrators by leveraging     mishandling of the creator ID.

  - CVE-2016-4536: The client in OpenAFS before 1.6.17 does     not properly initialize the (1) AFSStoreStatus, (2)     AFSStoreVolumeStatus, (3) VldbListByAttributes, and (4)     ListAddrByAttributes structures, which might allow     remote attackers to obtain sensitive memory information     by leveraging access to RPC call traffic.

For Debian 7 'Wheezy', these problems have been fixed in version 1.6.1-3+deb7u6.

We recommend that you upgrade your openafs packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
255106	Linux Distros Unpatched Vulnerability : CVE-2016-4536	Nessus	Misc.	medium
91477	FreeBSD : openafs -- multiple vulnerabilities (bcbd3fe0-2b46-11e6-ae88-002590263bf5)	Nessus	FreeBSD Local Security Checks	medium
91360	Debian DLA-493-1 : openafs security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2016-4536

medium

Tenable Plugins

medium

medium

high