Lucene search

SecurityvulnsSECURITYVULNS:DOC:18842

HistoryJan 12, 2008 - 12:00 a.m.

[SECURITY] [DSA 1458-1] New openafs packages fix denial of service vulnerability

2008-01-1200:00:00

vulners.com

JSON

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Debian Security Advisory DSA-1458-1 [email protected]
http://www.debian.org/security/ Noah Meyerhans
January 10, 2008 http://www.debian.org/security/faq

Package : openafs
Vulnerability : programming error
Problem type : remote
Debian-specific: no
CVE Id(s) : CVE-2007-6599
BugTraq ID : 27132

A race condition in the OpenAFS fileserver allows remote attackers to
cause a denial of service (daemon crash) by simultaneously acquiring and
giving back file callbacks, which causes the handler for the
GiveUpAllCallBacks RPC to perform linked-list operations without the
host_glock lock.

For the stable distribution (etch), this problem has been fixed in
version 1.4.2-6etch1

For the old stable distribution (sarge), this problem has been fixed in
version 1.3.81-3sarge3

We recommend that you upgrade your openafs packages.

Upgrade instructions

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian 3.1 (oldstable)

Oldstable updates are available for alpha, amd64, arm, hppa, i386, ia64, m68k, mips, mipsel, powerpc, s390 and sparc.

Source archives:

http://security.debian.org/pool/updates/main/o/openafs/openafs_1.3.81-3sarge3.dsc
Size/MD5 checksum: 851 e976cc846cb191828237473b1d0e4983
http://security.debian.org/pool/updates/main/o/openafs/openafs_1.3.81.orig.tar.gz
Size/MD5 checksum: 13455346 d754e92f7a0cd9824991c850e001884c
http://security.debian.org/pool/updates/main/o/openafs/openafs_1.3.81-3sarge3.diff.gz
Size/MD5 checksum: 261881 e28ed82f25816569ae6f1e74c7cd651b

Architecture independent packages:

http://security.debian.org/pool/updates/main/o/openafs/openafs-modules-source_1.3.81-3sarge3_all.deb
Size/MD5 checksum: 4616288 3e229a9fe2d2b561a71622feac362a0a

alpha architecture (DEC Alpha)

http://security.debian.org/pool/updates/main/o/openafs/openafs-fileserver_1.3.81-3sarge3_alpha.deb
Size/MD5 checksum: 1111526 3c76348f4a27d5cda9aaa689ae9b1e11
http://security.debian.org/pool/updates/main/o/openafs/libpam-openafs-kaserver_1.3.81-3sarge3_alpha.deb
Size/MD5 checksum: 271230 33707e0d7ad8bb2b2ed152e5d92ae1fb
http://security.debian.org/pool/updates/main/o/openafs/openafs-dbserver_1.3.81-3sarge3_alpha.deb
Size/MD5 checksum: 693318 8977f1b81728d32a2f58fc7adaba7a49
http://security.debian.org/pool/updates/main/o/openafs/openafs-kpasswd_1.3.81-3sarge3_alpha.deb
Size/MD5 checksum: 306556 c68d43f0a515c3ef40c26a69c3fa5267
http://security.debian.org/pool/updates/main/o/openafs/openafs-client_1.3.81-3sarge3_alpha.deb
Size/MD5 checksum: 2228482 4df236f17ca09f966381191bc744738c
http://security.debian.org/pool/updates/main/o/openafs/libopenafs-dev_1.3.81-3sarge3_alpha.deb
Size/MD5 checksum: 1892222 47914dd9a679b3e5ef7073d2c9b992f9

amd64 architecture (AMD x86_64 (AMD64))

http://security.debian.org/pool/updates/main/o/openafs/libopenafs-dev_1.3.81-3sarge3_amd64.deb
Size/MD5 checksum: 1442304 440380aae37ad9570d3488b2b94c1f20
http://security.debian.org/pool/updates/main/o/openafs/openafs-dbserver_1.3.81-3sarge3_amd64.deb
Size/MD5 checksum: 555860 3d5eeca465e786c8e3aeaa0f3a33c237
http://security.debian.org/pool/updates/main/o/openafs/openafs-kpasswd_1.3.81-3sarge3_amd64.deb
Size/MD5 checksum: 246504 a1f8f9151ddf5d8b2223ccc9011262ea
http://security.debian.org/pool/updates/main/o/openafs/libpam-openafs-kaserver_1.3.81-3sarge3_amd64.deb
Size/MD5 checksum: 229864 b17737eccca71f36bc1d2353979a8c5f
http://security.debian.org/pool/updates/main/o/openafs/openafs-client_1.3.81-3sarge3_amd64.deb
Size/MD5 checksum: 1833444 365d0d014c6328440fcab8c9f8a7b290
http://security.debian.org/pool/updates/main/o/openafs/openafs-fileserver_1.3.81-3sarge3_amd64.deb
Size/MD5 checksum: 884294 72860be9817d2a76f7dee14f133e55c3

hppa architecture (HP PA RISC)

http://security.debian.org/pool/updates/main/o/openafs/openafs-kpasswd_1.3.81-3sarge3_hppa.deb
Size/MD5 checksum: 248674 8211521a46ed37194b1389206967afaa
http://security.debian.org/pool/updates/main/o/openafs/openafs-fileserver_1.3.81-3sarge3_hppa.deb
Size/MD5 checksum: 919204 c0fa4e2db69bcba11c9ee4dda530d361
http://security.debian.org/pool/updates/main/o/openafs/openafs-client_1.3.81-3sarge3_hppa.deb
Size/MD5 checksum: 1827896 4555b91cc17ff27b33012e56736b93e7
http://security.debian.org/pool/updates/main/o/openafs/openafs-dbserver_1.3.81-3sarge3_hppa.deb
Size/MD5 checksum: 555912 6eaa5c2f587367d3fb9ea0c991a2e42c
http://security.debian.org/pool/updates/main/o/openafs/libopenafs-dev_1.3.81-3sarge3_hppa.deb
Size/MD5 checksum: 1508082 076c45dfa9ac8f962c0f8cd3edca36ff
http://security.debian.org/pool/updates/main/o/openafs/libpam-openafs-kaserver_1.3.81-3sarge3_hppa.deb
Size/MD5 checksum: 250190 9f56665de9b2cdf4dd77d25e5ea80f67

i386 architecture (Intel ia32)

http://security.debian.org/pool/updates/main/o/openafs/libpam-openafs-kaserver_1.3.81-3sarge3_i386.deb
Size/MD5 checksum: 217500 700591848a35d23ce47290f24cae4fbd
http://security.debian.org/pool/updates/main/o/openafs/openafs-fileserver_1.3.81-3sarge3_i386.deb
Size/MD5 checksum: 783520 d59e41054171bc7d1fb0aba29f02a350
http://security.debian.org/pool/updates/main/o/openafs/openafs-client_1.3.81-3sarge3_i386.deb
Size/MD5 checksum: 1547026 79eaa3c48d97c4fef817247c422ccac3
http://security.debian.org/pool/updates/main/o/openafs/libopenafs-dev_1.3.81-3sarge3_i386.deb
Size/MD5 checksum: 1274902 a402d82dcccfcbb98900c10c819f74e4
http://security.debian.org/pool/updates/main/o/openafs/openafs-kpasswd_1.3.81-3sarge3_i386.deb
Size/MD5 checksum: 205700 371cba49e969d2177930a8c0fba08acb
http://security.debian.org/pool/updates/main/o/openafs/openafs-dbserver_1.3.81-3sarge3_i386.deb
Size/MD5 checksum: 466994 0dcffdb0d36cc18ee29c445fc2099fda

ia64 architecture (Intel ia64)

http://security.debian.org/pool/updates/main/o/openafs/openafs-dbserver_1.3.81-3sarge3_ia64.deb
Size/MD5 checksum: 767748 922758417f41c9042a0b981b4e821ed1
http://security.debian.org/pool/updates/main/o/openafs/openafs-client_1.3.81-3sarge3_ia64.deb
Size/MD5 checksum: 2592104 803aa4ef7d09ee197f24df23b795daf0
http://security.debian.org/pool/updates/main/o/openafs/openafs-kpasswd_1.3.81-3sarge3_ia64.deb
Size/MD5 checksum: 350256 d8fa12297f5356b49d29e6fb29091fda
http://security.debian.org/pool/updates/main/o/openafs/libpam-openafs-kaserver_1.3.81-3sarge3_ia64.deb
Size/MD5 checksum: 310280 290defd02a6dbf0f67f2ba58a2b476c9
http://security.debian.org/pool/updates/main/o/openafs/libopenafs-dev_1.3.81-3sarge3_ia64.deb
Size/MD5 checksum: 1841412 ffcad21ff23511bf2d63a3dbc64c36e3
http://security.debian.org/pool/updates/main/o/openafs/openafs-fileserver_1.3.81-3sarge3_ia64.deb
Size/MD5 checksum: 1277792 8d450683d8e95f67900405f18bc1b6de

powerpc architecture (PowerPC)

http://security.debian.org/pool/updates/main/o/openafs/openafs-dbserver_1.3.81-3sarge3_powerpc.deb
Size/MD5 checksum: 517662 9b59769223c18e987a77013f9d8c0300
http://security.debian.org/pool/updates/main/o/openafs/openafs-kpasswd_1.3.81-3sarge3_powerpc.deb
Size/MD5 checksum: 229684 abfc07fb1905dcf791061ed4150b26b6
http://security.debian.org/pool/updates/main/o/openafs/openafs-client_1.3.81-3sarge3_powerpc.deb
Size/MD5 checksum: 1692200 da974fc36d3d5d1341e77f80e86ee211
http://security.debian.org/pool/updates/main/o/openafs/openafs-fileserver_1.3.81-3sarge3_powerpc.deb
Size/MD5 checksum: 852162 4990eb799fef4094addf9fc20b92a8c6
http://security.debian.org/pool/updates/main/o/openafs/libopenafs-dev_1.3.81-3sarge3_powerpc.deb
Size/MD5 checksum: 1460262 1751615de133fcd2f5c4b029a32b1beb
http://security.debian.org/pool/updates/main/o/openafs/libpam-openafs-kaserver_1.3.81-3sarge3_powerpc.deb
Size/MD5 checksum: 223554 9df7d747f46b12eac1213c420d0c617f

s390 architecture (IBM S/390)

http://security.debian.org/pool/updates/main/o/openafs/openafs-dbserver_1.3.81-3sarge3_s390.deb
Size/MD5 checksum: 473236 e6614ec300bf67f58713a63c8295d9d9
http://security.debian.org/pool/updates/main/o/openafs/openafs-kpasswd_1.3.81-3sarge3_s390.deb
Size/MD5 checksum: 212084 4521ec178094273d6f853dfe9984b1e5
http://security.debian.org/pool/updates/main/o/openafs/libpam-openafs-kaserver_1.3.81-3sarge3_s390.deb
Size/MD5 checksum: 224854 b1b5099db8e51c7b06af169af1ae8473
http://security.debian.org/pool/updates/main/o/openafs/openafs-client_1.3.81-3sarge3_s390.deb
Size/MD5 checksum: 1536414 7b444adef57f3535661ecad5b91aa50d
http://security.debian.org/pool/updates/main/o/openafs/libopenafs-dev_1.3.81-3sarge3_s390.deb
Size/MD5 checksum: 1383964 076d2df92940591dcd09c3beeeb2e4fc
http://security.debian.org/pool/updates/main/o/openafs/openafs-fileserver_1.3.81-3sarge3_s390.deb
Size/MD5 checksum: 762240 6266fc592f0426aed77a62c8f45ca0a8

sparc architecture (Sun SPARC/UltraSPARC)

http://security.debian.org/pool/updates/main/o/openafs/libpam-openafs-kaserver_1.3.81-3sarge3_sparc.deb
Size/MD5 checksum: 215874 663b6fdfd91ea4f1b20d91d8a65b6021
http://security.debian.org/pool/updates/main/o/openafs/openafs-client_1.3.81-3sarge3_sparc.deb
Size/MD5 checksum: 1542632 18efaaad5c53eb8efc56d17ed9a49bd4
http://security.debian.org/pool/updates/main/o/openafs/libopenafs-dev_1.3.81-3sarge3_sparc.deb
Size/MD5 checksum: 1331536 77c16cc6d140ecb42b22e91e591cd56a
http://security.debian.org/pool/updates/main/o/openafs/openafs-fileserver_1.3.81-3sarge3_sparc.deb
Size/MD5 checksum: 775104 fd19130984d2434dd1f903117943b10c
http://security.debian.org/pool/updates/main/o/openafs/openafs-kpasswd_1.3.81-3sarge3_sparc.deb
Size/MD5 checksum: 209502 be4bb6a273b96ea8b895462f29f9176f
http://security.debian.org/pool/updates/main/o/openafs/openafs-dbserver_1.3.81-3sarge3_sparc.deb
Size/MD5 checksum: 459574 ba8061dcdd273138b1eec7a581f2505c

Debian (stable)

Stable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

http://security.debian.org/pool/updates/main/o/openafs/openafs_1.4.2-6etch1.diff.gz
Size/MD5 checksum: 117510 2e34f43b59444768ed69bde2e15c0f93
http://security.debian.org/pool/updates/main/o/openafs/openafs_1.4.2.orig.tar.gz
Size/MD5 checksum: 9210858 5c1c4c39a592ec52f5a4fa68f89ab7e3
http://security.debian.org/pool/updates/main/o/openafs/openafs_1.4.2-6etch1.dsc
Size/MD5 checksum: 879 7dc9cb6b160d09b9daa364a6b42573ff

Architecture independent packages:

http://security.debian.org/pool/updates/main/o/openafs/openafs-doc_1.4.2-6etch1_all.deb
Size/MD5 checksum: 2989598 a05f8ec2a6db2775f45dbc9e839da685
http://security.debian.org/pool/updates/main/o/openafs/openafs-modules-source_1.4.2-6etch1_all.deb
Size/MD5 checksum: 5739796 b88a073e49f76d86d0639eece8c15801

alpha architecture (DEC Alpha)

amd64 architecture (AMD x86_64 (AMD64))

hppa architecture (HP PA RISC)

http://security.debian.org/pool/updates/main/o/openafs/openafs-kpasswd_1.4.2-6etch1_hppa.deb
Size/MD5 checksum: 319832 be9dead7f0f3469ffdc1503eee98c2e0
http://security.debian.org/pool/updates/main/o/openafs/openafs-dbg_1.4.2-6etch1_hppa.deb
Size/MD5 checksum: 1796338 e0be88e194a7b3acb3f2086f0d09f7bd
http://security.debian.org/pool/updates/main/o/openafs/openafs-dbserver_1.4.2-6etch1_hppa.deb
Size/MD5 checksum: 645672 f1985fecfb5ebe14e277ec2f49ba6170
http://security.debian.org/pool/updates/main/o/openafs/openafs-fileserver_1.4.2-6etch1_hppa.deb
Size/MD5 checksum: 1183618 b49bd59c6b7484eb9a70cfebd7826a7a
http://security.debian.org/pool/updates/main/o/openafs/libopenafs-dev_1.4.2-6etch1_hppa.deb
Size/MD5 checksum: 2382642 69c2d83cdfb7f3a7b2eec451508a484b
http://security.debian.org/pool/updates/main/o/openafs/openafs-krb5_1.4.2-6etch1_hppa.deb
Size/MD5 checksum: 184270 38f5874405c51a2bf61049eb54831d67
http://security.debian.org/pool/updates/main/o/openafs/libpam-openafs-kaserver_1.4.2-6etch1_hppa.deb
Size/MD5 checksum: 479366 c22ca484b2c84cfd8d56bf6d32351289
http://security.debian.org/pool/updates/main/o/openafs/openafs-client_1.4.2-6etch1_hppa.deb
Size/MD5 checksum: 3285472 9c4399cf9778602467056cc974e08e7d

i386 architecture (Intel ia32)

ia64 architecture (Intel ia64)

powerpc architecture (PowerPC)

s390 architecture (IBM S/390)

sparc architecture (Sun SPARC/UltraSPARC)

These files will probably be moved into the stable distribution on
its next update.

For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: [email protected]
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFHhoQ4YrVLjBFATsMRAoZ8AJ4mZjjDojzJKq/GZd3rgnIP0UH3ygCeIB5S
90sF4u9P/lAJvSiggRmSZ4U=
=LYm0
-----END PGP SIGNATURE-----