Date: Wed, 24 Jul 2013 19:06:31 -0700 From: Russ Allbery <rra@...nford.edu> To: oss-security@...ts.openwall.com Subject: Two OpenAFS security advisories As previously disclosed on distros, and now disclosed here per the distros policy. The first one is a somewhat odd special case, as this isn't a newly-discovered vulnerability. However, it's become clear that brute-force attacks on DES are immediately practical, prompting a reimplementation of the security layer that's being treated as a security release by the OpenAFS project. (Also, it's been an embarassment for some time that AFS didn't have crypto agility and didn't support anything stronger than DES. That's finally fixed.) The two vulnerabilities are: OpenAFS Security Advisory 2013-0003 (CVE-2013-4134) OpenAFS uses Kerberos tickets to secure network traffic. For historical reasons, it has only supported the DES encryption algorithm to encrypt these tickets. The weakness of DES's 56 bit key space has long been known, however it has recently become possible to use that weakness to cheaply (around $100) and rapidly (approximately 23 hours) compromise a service's long term key. This vulnerability is a particular problem for OpenAFS because DES is the only encryption algorithm supported in current releases. OpenAFS Security Advisory 2013-0004 (CVE-2013-4135) The -encrypt option to the 'vos' volume management command should cause it to encrypt all data between client and server. However, in versions of OpenAFS later than 1.6.0, it has no effect, and data is transmitted with integrity protection only. In all versions of OpenAFS, vos -encrypt has no effect when combined with the -localauth option. The upstream advisories, patches, upgrade instructions, and so forth are available at: http://www.openafs.org/security/ -- Russ Allbery (rra@...nford.edu) <http://www.eyrie.org/~eagle/>
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.