PT-2013-1205 · Openafs · Openafs

Published 2013-03-12 · Updated 2017-08-29 · CVE-2013-1794

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenAFS versions prior to 1.6.5

Description The issue concerns multiple vulnerabilities in the OpenAFS package that can be exploited remotely, potentially leading to breaches of confidentiality, integrity, and availability of protected information. A buffer overflow in certain client utilities allows remote authenticated users to cause a denial of service and possibly execute arbitrary code via a long fileserver ACL entry.

Recommendations For OpenAFS versions prior to 1.6.5, update to version 1.6.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable client utilities until a patch is available. Avoid using long fileserver ACL entries in the affected utilities to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

CWE-189

Related Identifiers

BDU:2015-09679

CVE-2013-1794

DSA-2638-1

Affected Products

Openafs

References · 13

• https://security-tracker.debian.org/tracker/CVE-2013-1794 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-1794 · Vendor Advisory
• http://debian.org/security/2013/dsa-2638 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2014:244 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09679 · Security Note
• http://secunia.com/advisories/52480 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-1794 · Vendor Advisory
• http://openafs.org/pages/security/OPENAFS-SA-2013-001.txt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-1794 · Security Note
• http://secunia.com/advisories/52342 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-201404-05.xml · Note
• http://securityfocus.com/bid/58299 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/82582 · Note