Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 1 Dec 2016 20:05:42 +0100
From: Salvatore Bonaccorso <carnil@...ian.org>
To: OSS Security Mailinglist <oss-security@...ts.openwall.com>
Subject: CVE Request: OpenAFS: directory information leaks
 (OPENAFS-SA-2016-003)

Hi

The OpenAFS project has released a security advisory:

https://www.openafs.org/pages/security/OPENAFS-SA-2016-003.txt

OpenAFS Security Advisory 2016-003

> Topic: directory information leakage
>                                                                                                   
> Issued: 30 November, 2016
> Affected: OpenAFS client versions 1.0 through 1.6.19
>           OpenAFS servers versions 1.0 through 1.6.19
> 
> The contents of OpenAFS directories may be leaked in client cache partitions,
> in fileserver vice partitions, and on the wire for certain RPCs.
> 
> SUMMARY
> =======
> 
> Due to incomplete initialization or clearing of reused memory, OpenAFS
> directory objects are likely to contain "dead" directory entry information.
> This extraneous information is not active - that is, it is logically invisible
> to the fileserver and client. However, the leaked information is physically
> visible on the fileserver vice partition, on the wire in FetchData replies and
> other RPCs, and on the client cache partition. This constitutes a leak of
> directory information.

I'm attaching the full advisory for reference (and to have it int the
list archives).

Patches:

https://www.openafs.org/pages/security/openafs-sa-2016-003.patch
https://www.openafs.org/pages/security/openafs-sa-2016-003-master.patch

Could you please assign a CVE for the directory information leak issue
in OpenAFS?

Regards,
Salvatore

View attachment "OPENAFS-SA-2016-003.txt" of type "text/plain" (4779 bytes)

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.