Scientific Linux Security Update : openafs on SL5.x, SL6.x i386/x86_64 (20140411)

medium Nessus Plugin ID 73454

Language:

Synopsis

The remote Scientific Linux host is missing one or more security updates.

Description

An attacker with the ability to connect to an OpenAFS fileserver can trigger a buffer overflow, crashing the server.

The GetStatistics64 remote procedure call (RPC) was introduced in OpenAFS 1.4.8 as part of the support for fileserver partitions larger than 2 TiB. The GetStatistics64 RPC is used by remote administrative programs to retrieve statistical information about fileservers. The GetStatistics64 RPC requests do not require authentication.

A bug has been discovered in the GetStatistics64 RPC which can trigger a fileserver crash. The version argument of the GetStatistics64 RPC is used to determine how much memory is allocated for the RPC reply.
However the range of this argument is not validated, allowing an attacker to cause insufficient memory to be allocated for the statistical information reply buffer.

Clients are not affected.

Solution

Update the affected packages.

Plugin Details

Severity: Medium

ID: 73454

File Name: sl_20140411_openafs_on_SL5_x.nasl

Version: 1.7

Type: local

Agent: unix

Family: Scientific Linux Local Security Checks

Published: 4/10/2014

Updated: 1/14/2021

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: Medium

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

Vulnerability Information

CPE: p-cpe:/a:fermilab:scientific_linux:openafs-server, x-cpe:/o:fermilab:scientific_linux, p-cpe:/a:fermilab:scientific_linux:kernel-module-openafs-2.6.18-348.21.1.el5, p-cpe:/a:fermilab:scientific_linux:kernel-module-openafs-2.6.18-348.21.1.el5pae, p-cpe:/a:fermilab:scientific_linux:kernel-module-openafs-2.6.18-348.21.1.el5xen, p-cpe:/a:fermilab:scientific_linux:kmod-openafs-431, p-cpe:/a:fermilab:scientific_linux:openafs, p-cpe:/a:fermilab:scientific_linux:openafs-authlibs, p-cpe:/a:fermilab:scientific_linux:openafs-authlibs-devel, p-cpe:/a:fermilab:scientific_linux:openafs-client, p-cpe:/a:fermilab:scientific_linux:openafs-compat, p-cpe:/a:fermilab:scientific_linux:openafs-debug, p-cpe:/a:fermilab:scientific_linux:openafs-devel, p-cpe:/a:fermilab:scientific_linux:openafs-kernel-source, p-cpe:/a:fermilab:scientific_linux:openafs-kpasswd, p-cpe:/a:fermilab:scientific_linux:openafs-krb5, p-cpe:/a:fermilab:scientific_linux:openafs-module-tools, p-cpe:/a:fermilab:scientific_linux:openafs-plumbing-tools

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Patch Publication Date: 4/11/2014

Vulnerability Publication Date: 4/14/2014

Reference Information

CVE: CVE-2014-0159

Detections

Analytics