rx/rx.c in OpenAFS 1.5.75 through 1.5.78, 1.6.x before 1.6.15, and 1.7.x before 1.7.33 does not properly initialize padding at the end of an Rx acknowledgement (ACK) packet, which allows remote attackers to obtain sensitive information by (1) conducting a replay attack or (2) sniffing the network.

Several vulnerabilities have been found and solved in the distributed file system OpenAFS :

CVE-2015-3282

vos leaked stack data clear on the wire when updating vldb entries.

CVE-2015-3283

OpenAFS allowed remote attackers to spoof bos commands via unspecified vectors.

CVE-2015-3285

pioctl wrongly used the pointer related to the RPC, allowing local users to cause a denial of service (memory corruption and kernel panic) via a crafted OSD FS command.

CVE-2015-6587

vlserver allowed remote authenticated users to cause a denial of service (out-of-bounds read and crash) via a crafted regular expression in a VL_ListAttributesN2 RPC.

CVE-2015-7762 and CVE-2015-7763 ('Tattletale')

John Stumpo found that Rx ACK packets leaked plaintext of packets previously processed.

For Debian 6 'Squeeze', these problems have been fixed in openafs version 1.4.12.1+dfsg-4+squeeze4.

We recommend that you upgrade your OpenAFS packages.

Learn more about the Debian Long Term Support (LTS) Project and how to apply these updates at: https://wiki.debian.org/LTS/

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

John Stumpo discovered that OpenAFS, a distributed file system, does not fully initialize certain network packets before transmitting them.
This can lead to a disclosure of the plaintext of previously processed packets.

This release fixes the high impact security vulnerability named 'Tattletale'

The packet paylod of Rx ACK packets is not fully initialized, leaking plaintext from packets previously processed.

The OpenAFS development team reports :

When constructing an Rx acknowledgment (ACK) packet, Andrew-derived Rx implementations do not initialize three octets of data that are padding in the C language structure and were inadvertently included in the wire protocol (CVE-2015-7762). Additionally, OpenAFS Rx in versions 1.5.75 through 1.5.78, 1.6.0 through 1.6.14, and 1.7.0 through 1.7.32 include a variable-length padding at the end of the ACK packet, in an attempt to detect the path MTU, but only four octets of the additional padding are initialized (CVE-2015-7763).

ID	Name	Product	Family	Severity
86920	Debian DLA-342-1 : openafs security update	Nessus	Debian Local Security Checks	medium
86681	Debian DSA-3387-1 : openafs - security update	Nessus	Debian Local Security Checks	medium
86671	Scientific Linux Security Update : openafs on SL5.x, SL6.x, SL7.x i386/x86_64 (20151021)	Nessus	Scientific Linux Local Security Checks	medium
86645	FreeBSD : openafs -- information disclosure (017a493f-7db6-11e5-a762-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2015-7763

high

Tenable Plugins

medium

medium

medium

medium