The cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58, and IBM AFS 3.6 before Patch 19, on Linux allows remote attackers to cause a denial of service (system crash) via an RX response with a large error-code value that is interpreted as a pointer and dereferenced, related to use of the ERR_PTR macro.

The remote host is affected by the vulnerability described in GLSA-201404-05 (OpenAFS: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in OpenAFS. Please review       the CVE identifiers referenced below for details.
  Impact :

    An attacker could potentially execute arbitrary code with the       permissions of the user running the AFS server, cause a Denial of Service       condition, or gain access to sensitive information. Additionally, an       attacker could compromise a cell&rsquo;s private key, allowing them to       impersonate any user in the cell.
  Workaround :

    There is no known workaround at this time.

An attacker with control of a fileserver, or the ability to forge RX packets, can crash the cache manager, and hence the kernel, of affected Linux AFS clients. (CVE-2009-1250)

An attacker with control of a fileserver, or the ability to forge RX packets, can crash the cache manager, and hence the kernel, of any Unix AFS client. It may be possible for an attacker to cause the kernel to execute arbitrary code. (CVE-2009-1251)

The Scientific Linux Team has backported the patches to the stable version of openafs for SL3, SL4 and SL5.

openafs must be restarted for the update to take effect.

The remote host is affected by the vulnerability described in GLSA-201101-05 (OpenAFS: Arbitrary code execution)

    Two vulnerabilities were discovered:
    Simon Wilkinson discovered from a bug report by Toby Blake that the     cache manager of OpenAFS contains a heap-based buffer overflow which is     related to the use of the ERR_PTR macro (CVE-2009-1250).
    A     pointer dereference bug when using XDR arrays was discovered by Simon     Wilkinson, with assistance from Derrick Brashear and Jeffrey Altman.
    (CVE-2009-1251).
  Impact :

    The vulnerabilities might allow remote unauthenticated attackers to     cause a Denial of Service (system crash) and possibly execute arbitrary     code.
  Workaround :

    There is no known workaround at this time.

Multiple vulnerabilities has been found and corrected in openafs :

The cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58 on Linux allows remote attackers to cause a denial of service (system crash) via an RX response with a large error-code value that is interpreted as a pointer and dereferenced, related to use of the ERR_PTR macro (CVE-2009-1250).

Heap-based buffer overflow in the cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58 on Unix platforms allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via an RX response containing more data than specified in a request, related to use of XDR arrays (CVE-2009-1251).

The updated packages have been patched to correct these issues.

Update :

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

Two vulnerabilities were discovered in the client part of OpenAFS, a distributed file system.

  - CVE-2009-1251     An attacker with control of a file server or the ability     to forge RX packets may be able to execute arbitrary     code in kernel mode on an OpenAFS client, due to a     vulnerability in XDR array decoding.

  - CVE-2009-1250     An attacker with control of a file server or the ability     to forge RX packets may crash OpenAFS clients because of     wrongly handled error return codes in the kernel module.

Note that in order to apply this security update, you must rebuild the OpenAFS kernel module. Be sure to also upgrade openafs-modules-source, build a new kernel module for your system following the instructions in /usr/share/doc/openafs-client/README.modules.gz, and then either stop and restart openafs-client or reboot the system to reload the kernel module.

ID	Name	Product	Family	Severity
73394	GLSA-201404-05 : OpenAFS: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
60579	Scientific Linux Security Update : openafs on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	critical
51535	GLSA-201101-05 : OpenAFS: Arbitrary code execution	Nessus	Gentoo Local Security Checks	critical
38192	Mandriva Linux Security Advisory : openafs (MDVSA-2009:099-1)	Nessus	Mandriva Local Security Checks	critical
36135	Debian DSA-1768-1 : openafs - several vulnerabilities	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2009-1250

high

Tenable Plugins

critical

critical

critical

critical

critical