CVE-2015-3282

vos in OpenAFS before 1.6.13, when updating VLDB entries, allows remote attackers to obtain stack data by sniffing the network...

CVE-2015-3283

OpenAFS before 1.6.13 allows remote attackers to spoof bos commands via unspecified vectors...

CVE-2015-3282

OpenAFS vos vulnerability CVE-2015-3282 affects OpenAFS prior to 1.6.13; on VLDB entry updates, stack data can be leaked over the network. The issue is mitigated by upgrading to a newer OpenAFS release (e.g., 1.6.13+ per description) or distribution-specific advisories recommending updated OpenAF...

CVE-2015-3283

OpenAFS is affected by CVE-2015-3283: remote attackers can spoof bos commands via unspecified vectors in OpenAFS versions before 1.6.13. Debian/Mageia advisories and Debian OpenAFS bulletin list this alongside related CVEs (e.g., CVE-2015-3282, CVE-2015-3285, CVE-2015-6587) and recommend upgradin...

CVE-2015-3282

vos in OpenAFS before 1.6.13, when updating VLDB entries, allows remote attackers to obtain stack data by sniffing the network...

CVE-2015-3285

OpenAFS CVE-2015-3285 affects OpenAFS before 1.6.13. The pioctl handling of the OSD FS command uses the wrong pointer when writing RPC results, enabling a local attacker to trigger memory corruption and kernel panic via a crafted OSD FS command. Impact is local, with potential denial of service. ...

CVE-2015-3284

OpenAFS 1.6.x before 1.6.13 is affected by CVE-2015-3284 where local users can read kernel memory via crafted pioctls. Root cause: vulnerability in pioctls handling exposes kernel memory. Public references note this CVE alongside related issues in the same OpenAFS update set (CVE-2015-3282/3283/3...

CVE-2015-3284

pioctls in OpenAFS 1.6.x before 1.6.13 allows local users to read kernel memory via crafted commands...

CVE-2015-3285

The pioctl for the OSD FS command in OpenAFS before 1.6.13 uses the wrong pointer when writing the results of the RPC, which allows local users to cause a denial of service memory corruption and kernel panic via a crafted OSD FS command...

CVE-2015-3284: Exposure of Sensitive Information to an Unauthorized Actor

pioctls in OpenAFS 1.6.x before 1.6.13 allows local users to read kernel memory via crafted commands...

PT-2015-6135

Name of the Vulnerable Software and Affected Versions OpenAFS versions prior to 1.6.13 Description The issue is related to a buffer overflow in the Solaris kernel extension, which can be triggered by a large group list when joining a PAG. This can cause a denial of service, resulting in a panic o...

CVE-2015-3285: Improper Restriction of Operations within the Bounds of a Memory Buffer

The pioctl for the OSD FS command in OpenAFS before 1.6.13 uses the wrong pointer when writing the results of the RPC, which allows local users to cause a denial of service memory corruption and kernel panic via a crafted OSD FS command...

CVE-2015-3283: Undefined Security Weakness

OpenAFS before 1.6.13 allows remote attackers to spoof bos commands via unspecified vectors...

CVE-2015-3282: Exposure of Sensitive Information to an Unauthorized Actor

vos in OpenAFS before 1.6.13, when updating VLDB entries, allows remote attackers to obtain stack data by sniffing the network...

CVE-2015-3286: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in the Solaris kernel extension in OpenAFS before 1.6.13 allows local users to cause a denial of service panic or deadlock or possibly have other unspecified impact via a large group list when joining a PAG...

[SECURITY] [DSA 3320-1] openafs security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3320-1 [email protected] https://www.debian.org/security/ Sebastien Delafond July 30, 2015 https://www.debian.org/security/faq -...

OpenAFS multiple security vulnerabilities

Information disclosure, DoS...

Scientific Linux Security Update : openafs on SL5.x, SL6.x, SL7.x i386/x86_64 (20150730)

All server platforms Fix for CVE-2015-3282: vos leaks stack data onto the wire in the clear when creating vldb entries Workaround for CVE-2015-3283: bos commands can be spoofed, including some which alter server state Disabled searching the VLDB by volume name regular expression to avoid possible...

Debian DSA-3320-1 : openafs - security update

It was discovered that OpenAFS, the implementation of the distributed filesystem AFS, contained several flaws that could result in information leak, denial-of-service or kernel panic. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

[SECURITY] [DSA 3320-1] openafs security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3320-1 [email protected] https://www.debian.org/security/ Sebastien Delafond July 30, 2015 https://www.debian.org/security/faq -...