PT-2011-1192 · Openafs · Openafs

Publicado 2011-02-18 · Atualizado 2014-04-07 · CVE-2011-0431

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenAFS versions 1.4.7 through 1.4.14 OpenAFS versions prior to 1.6.5

Description The issue is related to the improper handling of errors in the afs linux lock function, which can lead to a denial of service. Additionally, there are multiple vulnerabilities in the openafs package that can compromise the confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely.

Recommendations For OpenAFS versions 1.4.7 through 1.4.14, update to a version later than 1.4.14. For OpenAFS versions prior to 1.6.5, update to version 1.6.5 or later. As a temporary workaround, consider restricting access to the vulnerable function until a patch is available.

Correção

RCE

Enumeração de Fraquezas

CWE-20

CWE-189

Identificadores relacionados

BDU:2015-09679

CVE-2011-0431

DSA-2168-1

Produtos afetados

Openafs

Referências · 13

• http://security.gentoo.org/glsa/glsa-201404-05.xml · Nota
• http://debian.org/security/2011/dsa-2168 · Aviso do Fabricante
• http://vupen.com/english/advisories/2011/0410 · Aviso do Fabricante
• http://securitytracker.com/id?1025095 · Nota
• http://secunia.com/advisories/43407 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2011-0431 · Aviso do Fabricante
• http://vupen.com/english/advisories/2011/0411 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-0431 · Aviso do Fabricante
• http://securityfocus.com/bid/46428 · Nota
• https://bdu.fstec.ru/vul/2015-09679 · Nota de Segurança
• http://secunia.com/advisories/43371 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2011-0431 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2011-0431 · Nota de Segurança