The newEntry function in ptserver/ptprocs.c in OpenAFS before 1.6.17 allows remote authenticated users from foreign Kerberos realms to bypass intended access restrictions and create arbitrary groups as administrators by leveraging mishandling of the creator ID.

The OpenAFS development team reports :

Foreign users can bypass access controls to create groups as system:administrators, including in the user namespace and the system:
namespace.

The contents of uninitialized memory are sent on the wire when clients perform certain RPCs. Depending on the RPC, the information leaked may come from kernel memory or userspace.

- CVE-2015-8312: Off-by-one error in afs_pioctl.c in     OpenAFS before 1.6.16 might allow local users to cause a     denial of service (memory overwrite and system crash)     via a pioctl with an input buffer size of 4096 bytes.

  - CVE-2016-2860: The newEntry function in     ptserver/ptprocs.c in OpenAFS before 1.6.17 allows     remote authenticated users from foreign Kerberos realms     to bypass intended access restrictions and create     arbitrary groups as administrators by leveraging     mishandling of the creator ID.

  - CVE-2016-4536: The client in OpenAFS before 1.6.17 does     not properly initialize the (1) AFSStoreStatus, (2)     AFSStoreVolumeStatus, (3) VldbListByAttributes, and (4)     ListAddrByAttributes structures, which might allow     remote attackers to obtain sensitive memory information     by leveraging access to RPC call traffic.

For Debian 7 'Wheezy', these problems have been fixed in version 1.6.1-3+deb7u6.

We recommend that you upgrade your openafs packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Two vulnerabilities were discovered in openafs, an implementation of the distributed filesystem AFS. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2015-8312     Potential denial of service caused by a bug in the     pioctl logic allowing a local user to overrun a kernel     buffer with a single NUL byte.

  - CVE-2016-2860     Peter Iannucci discovered that users from foreign     Kerberos realms can create groups as if they were     administrators.

--

This release fixes the vulnerabilities tracked as OPENAFS-SA-2016-001 and OPENAFS-SA-2016-002.

OPENAFS-SA-2016-001 (CVE-2016-2860): Users from foreign Kerberos realms can create groups as if they were administrators

OPENAFS-SA-2016-002: Information leakage over the network due to uninitialized memory

For more details please see

<a href='http://www.openafs.org/pages/security/OPENAFS-SA-2016-001.txt' target='_blank'>http://www.openafs.org/pages/security/OPENAFS-SA-2016- 001.txt</a> <a href='http://www.openafs.org/pages/security/OPENAFS-SA-2016-002.txt' target='_blank'>http://www.openafs.org/pages/security/OPENAFS-SA-2016- 002.txt</a>

ID	Name	Product	Family	Severity
91477	FreeBSD : openafs -- multiple vulnerabilities (bcbd3fe0-2b46-11e6-ae88-002590263bf5)	Nessus	FreeBSD Local Security Checks	medium
91360	Debian DLA-493-1 : openafs security update	Nessus	Debian Local Security Checks	high
90928	Debian DSA-3569-1 : openafs - security update	Nessus	Debian Local Security Checks	high
90020	Scientific Linux Security Update : OpenAFS on SL5.x, SL6.x, SL7.x i386/x86_64 (20160317)	Nessus	Scientific Linux Local Security Checks	medium

Detections

Analytics

CVE-2016-2860

medium

Tenable Plugins

medium

high

high

medium