OpenAFS - Denial of Service and Arbitrary Group Creation Vulnerabilities
Summary
DLA-493-1: openafs - security update. Affects openafs versions < 1.6.1-3+deb7u6. Fixed in 1.6.1-3+deb7u6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenAFS is an open-source distributed file system that allows users to access and share files across multiple machines. It provides a scalable and secure solution for managing large amounts of data. However, OpenAFS versions prior to 1.6.17 are vulnerable to two security issues: an off-by-one error and a bypass of access restrictions.
Vulnerability Detail
The first vulnerability, identified as CVE-2015-8312, is an off-by-one error in the afs_pioctl.c file. This flaw allows local users to cause a denial of service by overwriting memory and crashing the system through a pioctl with an input buffer size of 4096 bytes. The second vulnerability, CVE-2016-2860, affects the newEntry function in ptserver/ptprocs.c. It enables remote authenticated users from foreign Kerberos realms to bypass access restrictions and create arbitrary groups as administrators by exploiting mishandling of the creator ID. Additionally, CVE-2016-4536 affects the OpenAFS client by not properly initializing certain structures, potentially exposing sensitive memory information to remote attackers with access to RPC call traffic.
How To Fix
Minimum fixed version
1.6.1-3+deb7u6
This is the first release that contains the fix.
sudo apt-get install --only-upgrade openafsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is crucial to apply the provided fix by upgrading to the latest version of OpenAFS to mitigate the risk of exploitation.
Conclusion
OpenAFS versions prior to 1.6.17 are susceptible to a denial of service vulnerability (CVE-2015-8312) and a bypass of access restrictions vulnerability (CVE-2016-2860). These issues can be mitigated by upgrading to OpenAFS version 1.6.17 or later. It is crucial to promptly apply the provided fix to ensure the security and stability of your OpenAFS deployment. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for openafs →
FAQ
CVE-2015-8312 can be exploited by local users to crash the system, leading to a denial of service. However, it does not allow for remote code execution or unauthorized access to sensitive information.
CVE-2016-2860 affects OpenAFS installations where remote authenticated users from foreign Kerberos realms have access. If your OpenAFS deployment involves such users, it is recommended to apply the provided fix to prevent unauthorized group creation.
You can use the Vulert Playground at Vulert Scanner to check if your OpenAFS installation is affected by these vulnerabilities. Simply upload your package-lock.json file to the playground, and it will provide real-time alerts if any vulnerabilities are detected.
At the time of this report, there are no known public exploits targeting these vulnerabilities. However, it is essential to apply the recommended fix promptly to minimize the risk of exploitation.
You can find more information about OpenAFS security advisories, including how to apply updates and frequently asked questions, on the Debian LTS Wiki at https://wiki.debian.org/LTS.
Related vulnerabilities
Recent vulnerabilities recorded for openafs.
