Detections
Analytics
Mandriva Linux Security Advisory : openafs (MDVSA-2009:099-1)
critical Nessus Plugin ID 38192
Synopsis
The remote Mandriva Linux host is missing one or more security updates.Description
Multiple vulnerabilities has been found and corrected in openafs :The cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58 on Linux allows remote attackers to cause a denial of service (system crash) via an RX response with a large error-code value that is interpreted as a pointer and dereferenced, related to use of the ERR_PTR macro (CVE-2009-1250).
Heap-based buffer overflow in the cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58 on Unix platforms allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via an RX response containing more data than specified in a request, related to use of XDR arrays (CVE-2009-1251).
The updated packages have been patched to correct these issues.
Update :
Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers
Solution
Update the affected packages.Plugin Details
Severity: Critical
ID: 38192
File Name: mandriva_MDVSA-2009-099.nasl
Version: 1.18
Type: local
Family: Mandriva Local Security Checks
Published: 4/28/2009
Updated: 1/6/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 8.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: p-cpe:/a:mandriva:linux:dkms-libafs, p-cpe:/a:mandriva:linux:lib64openafs1, p-cpe:/a:mandriva:linux:lib64openafs1-devel, p-cpe:/a:mandriva:linux:libopenafs1, p-cpe:/a:mandriva:linux:libopenafs1-devel, p-cpe:/a:mandriva:linux:openafs, p-cpe:/a:mandriva:linux:openafs-client, p-cpe:/a:mandriva:linux:openafs-doc, p-cpe:/a:mandriva:linux:openafs-server, cpe:/o:mandriva:linux:2008.0
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list
Exploit Ease: No known exploits are available
Patch Publication Date: 12/8/2009
Reference Information
CVE: CVE-2009-1250, CVE-2009-1251