Scientific Linux Security Update : Moderate: OpenAFS on SL6.x, SL7.x i386/x86_64 (20180911)

high Nessus Plugin ID 117472

Language:

Synopsis

The remote Scientific Linux host is missing one or more security updates.

Description

These releases include fixes for three security advisories, OPENAFS-SA-2018-001, OPENAFS-SA-2018-002, and OPENAFS-SA-2018-003.

OPENAFS-SA-2018-001 only affects deployments that run the 'butc' utility as part of the in-tree backup system, but is of high severity for those sites which are affected -- an anonymous attacker could replace entire volumes with attacker-controlled contents.

OPENAFS-SA-2018-002 is for information leakage over the network via uninitialized RPC output variables. A number of RPCs are affected, some of which require the caller to be authenticated, but in some cases hundreds of bytes of data can be leaked per call. Of note is that cache managers are also subject to (kernel) memory leakage via AFSCB_ RPCs.

OPENAFS-SA-2018-003 is a denial of service whereby anonymous attackers can cause server processes to consume large quantities of memory for a sustained period of time.

The changes to fix OPENAFS-SA-2018-001 require behavior change in both butc(8) and backup(8) to use authenticated connections; old and new versions of these utilities will not interoperate absent specific configuration of the new tool to use the old (insecure) behavior.
These changes also are expected to cause backup(8)'s interactive mode to be limited to only butc connections requiring (or not requiring) authentication within a given interactive session, based on the initial arguments selected.

Solution

Update the affected packages.

Plugin Details

Severity: High

ID: 117472

File Name: sl_20180911_Moderate__OpenAFS_on_SL6_x.nasl

Version: 1.3

Type: local

Agent: unix

Family: Scientific Linux Local Security Checks

Published: 9/13/2018

Updated: 2/24/2020

Supported Sensors: Nessus Agent, Nessus

Vulnerability Information

CPE: p-cpe:/a:fermilab:scientific_linux:kmod-openafs-1.6-sl-862, p-cpe:/a:fermilab:scientific_linux:kmod-openafs-1.6-sl-862-debuginfo, p-cpe:/a:fermilab:scientific_linux:kmod-openafs-754, p-cpe:/a:fermilab:scientific_linux:openafs, p-cpe:/a:fermilab:scientific_linux:openafs-1.6-sl, p-cpe:/a:fermilab:scientific_linux:openafs-1.6-sl-authlibs, p-cpe:/a:fermilab:scientific_linux:openafs-1.6-sl-authlibs-devel, p-cpe:/a:fermilab:scientific_linux:openafs-1.6-sl-client, p-cpe:/a:fermilab:scientific_linux:openafs-1.6-sl-compat, p-cpe:/a:fermilab:scientific_linux:openafs-1.6-sl-debuginfo, p-cpe:/a:fermilab:scientific_linux:openafs-1.6-sl-devel, p-cpe:/a:fermilab:scientific_linux:openafs-1.6-sl-kernel-source, p-cpe:/a:fermilab:scientific_linux:openafs-1.6-sl-kpasswd, p-cpe:/a:fermilab:scientific_linux:openafs-1.6-sl-krb5, p-cpe:/a:fermilab:scientific_linux:openafs-1.6-sl-module-tools, p-cpe:/a:fermilab:scientific_linux:openafs-1.6-sl-plumbing-tools, p-cpe:/a:fermilab:scientific_linux:openafs-1.6-sl-server, p-cpe:/a:fermilab:scientific_linux:openafs-authlibs, p-cpe:/a:fermilab:scientific_linux:openafs-authlibs-devel, p-cpe:/a:fermilab:scientific_linux:openafs-client, p-cpe:/a:fermilab:scientific_linux:openafs-compat, p-cpe:/a:fermilab:scientific_linux:openafs-debuginfo, p-cpe:/a:fermilab:scientific_linux:openafs-devel, p-cpe:/a:fermilab:scientific_linux:openafs-kernel-source, p-cpe:/a:fermilab:scientific_linux:openafs-kpasswd, p-cpe:/a:fermilab:scientific_linux:openafs-krb5, p-cpe:/a:fermilab:scientific_linux:openafs-module-tools, p-cpe:/a:fermilab:scientific_linux:openafs-plumbing-tools, p-cpe:/a:fermilab:scientific_linux:openafs-server, x-cpe:/o:fermilab:scientific_linux

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Patch Publication Date: 9/11/2018

Vulnerability Publication Date: 9/11/2018

Detections

Analytics