GLSA-201101-05

Executive Summary

Summary
Title	OpenAFS: Arbitrary code execution

Informations
Name	GLSA-201101-05	First vendor Publication	2011-01-16
Vendor	Gentoo	Last vendor Modification	2011-01-16
Severity (Vendor)	Normal	Revision	N/A

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score	10	Attack Range	Network
Cvss Impact Score	10	Attack Complexity	Low
Cvss Expoit Score	10	Authentification	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Synopsis

The cache manager of OpenAFS contains several bugs resulting in remote execution of arbitrary code.

Background

OpenAFS is a distributed file system.

Description

Two vulnerabilites were discovered:

* Simon Wilkinson discovered from a bug report by Toby Blake that the cache manager of OpenAFS contains a heap-based buffer overflow which is related to the use of the ERR_PTR macro (CVE-2009-1250).

* A pointer dereference bug when using XDR arrays was discovered by Simon Wilkinson, with assistance from Derrick Brashear and Jeffrey Altman. (CVE-2009-1251).

Impact

The vulnerabilites might allow remote unauthenticated attackers to cause a Denial of Service (system crash) and possibly execute arbitrary code.

Workaround

There is no known workaround at this time.

Resolution

All OpenAFS users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-fs/openafs-1.4.9"

References

[ 1 ] CVE-2009-1250 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1250
[ 2 ] CVE-2009-1251 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1251

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-201101-05.xml

Original Source

Url : http://security.gentoo.org/glsa/glsa-201101-05.xml

CWE : Common Weakness Enumeration

id	Name
CWE-189	Numeric Errors
CWE-119	Failure to Constrain Operations within the Bounds of a Memory Buffer

CPE : Common Platform Enumeration

Type	Description	Count
Application	Ibm Afs cpe:/a:ibm:afs:3.6:patch13 cpe:/a:ibm:afs:3.6:patch14 cpe:/a:ibm:afs:3.6:patch16 cpe:/a:ibm:afs:3.6:patch12 cpe:/a:ibm:afs:3.6:patch15 cpe:/a:ibm:afs:3.6 cpe:/a:ibm:afs:3.6:patch18	7
Application	Openafs Openafs cpe:/a:openafs:openafs:1.5.58 cpe:/a:openafs:openafs:1.5.57 cpe:/a:openafs:openafs:1.5.56 cpe:/a:openafs:openafs:1.5.55 cpe:/a:openafs:openafs:1.5.54 cpe:/a:openafs:openafs:1.5.53 cpe:/a:openafs:openafs:1.5.52 cpe:/a:openafs:openafs:1.5.50 cpe:/a:openafs:openafs:1.5.39 cpe:/a:openafs:openafs:1.5.38 cpe:/a:openafs:openafs:1.5.36 cpe:/a:openafs:openafs:1.5.35 cpe:/a:openafs:openafs:1.5.34 cpe:/a:openafs:openafs:1.5.33 cpe:/a:openafs:openafs:1.5.32 cpe:/a:openafs:openafs:1.5.31 cpe:/a:openafs:openafs:1.5.30 cpe:/a:openafs:openafs:1.5.27 cpe:/a:openafs:openafs:1.5.26 cpe:/a:openafs:openafs:1.5.17 cpe:/a:openafs:openafs:1.5.16 cpe:/a:openafs:openafs:1.5 cpe:/a:openafs:openafs:1.4.8_pre3 cpe:/a:openafs:openafs:1.4.8_pre2 cpe:/a:openafs:openafs:1.4.8_pre1 cpe:/a:openafs:openafs:1.4.8 cpe:/a:openafs:openafs:1.4.7_pre5 cpe:/a:openafs:openafs:1.4.7_pre4 cpe:/a:openafs:openafs:1.4.7_pre3 cpe:/a:openafs:openafs:1.4.7_pre2 cpe:/a:openafs:openafs:1.4.7_pre1 cpe:/a:openafs:openafs:1.4.7 cpe:/a:openafs:openafs:1.4.6 cpe:/a:openafs:openafs:1.4.5 cpe:/a:openafs:openafs:1.4.4 cpe:/a:openafs:openafs:1.4.3 cpe:/a:openafs:openafs:1.4.0 cpe:/a:openafs:openafs:1.4 cpe:/a:openafs:openafs:1.3.81 cpe:/a:openafs:openafs:1.3.77 cpe:/a:openafs:openafs:1.3.74 cpe:/a:openafs:openafs:1.3.70 cpe:/a:openafs:openafs:1.3.5 cpe:/a:openafs:openafs:1.3.2 cpe:/a:openafs:openafs:1.3.1 cpe:/a:openafs:openafs:1.3 cpe:/a:openafs:openafs:1.2.9 cpe:/a:openafs:openafs:1.2.8 cpe:/a:openafs:openafs:1.2.7 cpe:/a:openafs:openafs:1.2.6 cpe:/a:openafs:openafs:1.2.5 cpe:/a:openafs:openafs:1.2.4 cpe:/a:openafs:openafs:1.2.3 cpe:/a:openafs:openafs:1.2.2b cpe:/a:openafs:openafs:1.2.2a cpe:/a:openafs:openafs:1.2.2 cpe:/a:openafs:openafs:1.2.13 cpe:/a:openafs:openafs:1.2.11 cpe:/a:openafs:openafs:1.2.10 cpe:/a:openafs:openafs:1.2.1 cpe:/a:openafs:openafs:1.2 cpe:/a:openafs:openafs:1.1.1a cpe:/a:openafs:openafs:1.1.1 cpe:/a:openafs:openafs:1.1.0 cpe:/a:openafs:openafs:1.1 cpe:/a:openafs:openafs:1.0.4a cpe:/a:openafs:openafs:1.0.4 cpe:/a:openafs:openafs:1.0.3 cpe:/a:openafs:openafs:1.0.2 cpe:/a:openafs:openafs:1.0.1 cpe:/a:openafs:openafs:1.0	71
Os	Unix Unix cpe:/o:unix:unix	1

Open Source Vulnerability Database (OSVDB)

id	Description
55274	OpenAFS Client on Unix Cache Manager RX Response Handling Remote Overflow
55273	OpenAFS Client on Linux Cache Manager RX Response Handling Remote DoS