OpenAFS 1.x before 1.6.22 does not properly validate Rx ack packets, which allows remote attackers to cause a denial of service (system crash or application crash) via crafted fields, as demonstrated by an integer underflow and assertion failure for a small MTU value.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - OpenAFS 1.x before 1.6.22 does not properly validate Rx ack packets, which allows remote attackers to     cause a denial of service (system crash or application crash) via crafted fields, as demonstrated by an     integer underflow and assertion failure for a small MTU value. (CVE-2017-17432)

Note that Nessus relies on the presence of the package as reported by the vendor.

CVE-2017-17432 It was discovered that malformed jumbogram packets could result in denial of service against OpenAFS, an implementation of the Andrew distributed file system.

For Debian 7 'Wheezy', these problems have been fixed in version 1.6.1-3+deb7u8.

We recommend that you upgrade your openafs packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that malformed jumbogram packets could result in denial of service against OpenAFS, an implementation of the Andrew distributed file system.

ID	Name	Product	Family	Severity
254772	Linux Distros Unpatched Vulnerability : CVE-2017-17432	Nessus	Misc.	high
105394	Debian DLA-1213-1 : openafs security update	Nessus	Debian Local Security Checks	high
105331	Debian DSA-4067-1 : openafs - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-17432

high

Tenable Plugins

high

high

high