PT-2015-7594 · Openafs · Openafs

John Stumpo · Publicado 2015-11-01 · Atualizado 2016-12-07 · CVE-2015-7763

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenAFS versions 1.5.75 through 1.5.78 OpenAFS versions 1.6.x before 1.6.15 OpenAFS versions 1.7.x before 1.7.33

Description The issue allows remote attackers to obtain sensitive information by conducting a replay attack or sniffing the network, due to improper initialization of padding at the end of an Rx acknowledgement (ACK) packet.

Recommendations For OpenAFS versions 1.5.75 through 1.5.78, update to a version later than 1.5.78 to resolve the issue. For OpenAFS versions 1.6.x before 1.6.15, update to version 1.6.15 or later to resolve the issue. For OpenAFS versions 1.7.x before 1.7.33, update to version 1.7.33 or later to resolve the issue.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2015-7763

DLA-342-1

DSA-3387-1

MGASA-2015-0424

Produtos afetados

Openafs

Referências · 26

• https://openafs.org/security · Nota
• https://openafs.org/dl/openafs/1.6.15/RELNOTES-1.6.15 · Aviso do Fabricante
• https://lists.openafs.org/pipermail/openafs-announce/2015/000493.html · Aviso do Fabricante
• http://openafs.org/dl/openafs/1.6.15/RELNOTES-1.6.15 · Nota
• http://debian.org/security/2015/dsa-3387 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/source-package/openafs · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7763 · Nota de Segurança
• http://openafs.org/dl/openafs/1.6.14.1/RELNOTES-1.6.14.1 · Nota
• https://security-tracker.debian.org/tracker/CVE-2015-7763 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2015-7763 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7762 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-7763 · Aviso do Fabricante
• https://packages.debian.org/src:openafs · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-7763 · Aviso do Fabricante
• https://osv.dev/vulnerability/MGASA-2015-0424 · Aviso do Fabricante