-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Fri, 21 Sep 2018 14:33:11 +0200 Source: openafs Binary: openafs-client openafs-fuse openafs-kpasswd openafs-fileserver openafs-dbserver openafs-doc openafs-krb5 libkopenafs1 libafsauthent1 libafsrpc1 libopenafs-dev openafs-modules-source openafs-modules-dkms libpam-openafs-kaserver openafs-dbg Architecture: source amd64 all Version: 1.6.9-2+deb8u8 Distribution: jessie-security Urgency: high Maintainer: Benjamin Kaduk <kaduk@mit.edu> Changed-By: Markus Koschany <apo@debian.org> Description: libafsauthent1 - AFS distributed file system runtime library (authentication) libafsrpc1 - AFS distributed file system runtime library (RPC layer) libkopenafs1 - AFS distributed file system runtime library (PAGs) libopenafs-dev - AFS distributed filesystem development libraries libpam-openafs-kaserver - AFS distributed filesystem kaserver PAM module openafs-client - AFS distributed filesystem client support openafs-dbg - AFS distributed filesystem debugging information openafs-dbserver - AFS distributed filesystem database server openafs-doc - AFS distributed filesystem documentation openafs-fileserver - AFS distributed filesystem file server openafs-fuse - AFS distributed file system experimental FUSE client openafs-kpasswd - AFS distributed filesystem old password changing openafs-krb5 - AFS distributed filesystem Kerberos 5 integration openafs-modules-dkms - AFS distributed filesystem kernel module DKMS source openafs-modules-source - AFS distributed filesystem kernel module source Changes: openafs (1.6.9-2+deb8u8) jessie-security; urgency=high . * Non-maintainer upload by the LTS team. * Fix CVE-2018-16947: The backup tape controller process accepts incoming RPCs but does not require (or allow for) authentication of those RPCs. Handling those RPCs results in operations being performed with administrator credentials, including dumping/restoring volume contents and manipulating the backup database. * Fix CVE-2018-16948: Several RPC server routines did not fully initialize their output variables before returning, leaking memory contents from both the stack and the heap. Because the OpenAFS cache manager functions as an Rx server for the AFSCB service, clients are also susceptible to information leakage. * Fix CVE-2018-16949: Several data types used as RPC input variables were implemented as unbounded array types, limited only by the inherent 32-bit length field to 4GB. An unauthenticated attacker could send, or claim to send, large input values and consume server resources waiting for those inputs, denying service to other valid connections. Checksums-Sha1: 2f927f0a24fc14ad5471dd1308b4c0ef2dc6a52d 4139 openafs_1.6.9-2+deb8u8.dsc 643d3126b633beca1604c0e2a0061482a0a255a4 163080 openafs_1.6.9-2+deb8u8.debian.tar.xz db60f45ea9117c2d040557128e69c8b84df85274 1968102 openafs-client_1.6.9-2+deb8u8_amd64.deb 4d5feecfa874c90cc1f1e5af3c818bd058473e10 285970 openafs-fuse_1.6.9-2+deb8u8_amd64.deb c70487ff9a70490eaa1a846b1cd7e605bbac0c3c 200240 openafs-kpasswd_1.6.9-2+deb8u8_amd64.deb 967be951d2af91e9df569fe6185546538ad72b83 1306864 openafs-fileserver_1.6.9-2+deb8u8_amd64.deb 38edfa098ba8de305e65687eab90ea4f09d054f3 452868 openafs-dbserver_1.6.9-2+deb8u8_amd64.deb f35c312d925e7aa920e097e025caedaf9ed0ed4b 4000050 openafs-doc_1.6.9-2+deb8u8_all.deb 9ce7592be2f852126267dcd97869d35b74d80962 259122 openafs-krb5_1.6.9-2+deb8u8_amd64.deb b23ab6a42e60035026911fb6b51226cb3055e643 91312 libkopenafs1_1.6.9-2+deb8u8_amd64.deb cfc20253ede3da60249e20225b46c2d0ba21011e 214620 libafsauthent1_1.6.9-2+deb8u8_amd64.deb e762f81f6ee84bb6696e7ec25973689f2726125f 199780 libafsrpc1_1.6.9-2+deb8u8_amd64.deb 4d3d71932b61c3d3e8b362184043a23ca5be3d75 1304994 libopenafs-dev_1.6.9-2+deb8u8_amd64.deb b388afd18832b3db8fb728efd71199718e19cf92 1165196 openafs-modules-source_1.6.9-2+deb8u8_all.deb 300b85e1f790a8e7cc80dd72e5650d5d19d95cca 941696 openafs-modules-dkms_1.6.9-2+deb8u8_all.deb f50e3803c6df3d4a7897605007d3755f5d6a0b38 188074 libpam-openafs-kaserver_1.6.9-2+deb8u8_amd64.deb 4efafec984c83255e3514a8b4875592a0babdaae 21920420 openafs-dbg_1.6.9-2+deb8u8_amd64.deb Checksums-Sha256: e3c1f5acdf16859632c92322a79db1de4ba3b25579d71242ae33b442dd8450c1 4139 openafs_1.6.9-2+deb8u8.dsc ebbf5e3c700230ac91659839c6274e35b5357c8309dd92af2464196e56bedaf8 163080 openafs_1.6.9-2+deb8u8.debian.tar.xz b80cd83ef8178b3bc72201c1ad46447a4903723bcc3cd850779f3f07bccef5d0 1968102 openafs-client_1.6.9-2+deb8u8_amd64.deb f9aaeb642219b060023ae90182bf72942fef97af0919d060ed40cb7d159af212 285970 openafs-fuse_1.6.9-2+deb8u8_amd64.deb 415d29590c134b3ffcb7689e64e805c24f9e55f222a14ce347230495dda8a551 200240 openafs-kpasswd_1.6.9-2+deb8u8_amd64.deb d7acb9052c5c95c17c48e0d9bfff03433933cf1ca9b204b18bd4c501dfbfb6cc 1306864 openafs-fileserver_1.6.9-2+deb8u8_amd64.deb a35e2a91d54ee610f492544a8ae13992b909bb8cb9868cc533ff18fc6cd6ef96 452868 openafs-dbserver_1.6.9-2+deb8u8_amd64.deb 9f44a1a489dc40f6dbcded8d16146fda7637a8c714eb1e9eb053fb02857cf374 4000050 openafs-doc_1.6.9-2+deb8u8_all.deb cc746a36e29c053c75bebe16e877af77444424a80c3510a0277a92ceb9954a03 259122 openafs-krb5_1.6.9-2+deb8u8_amd64.deb 0de261bae58f5b6270264a268af20ed470b24c505520b9c3fb7b8d78da978a7f 91312 libkopenafs1_1.6.9-2+deb8u8_amd64.deb 1f908a09108f9bdfdc210a20edaa96549ce16b5a86b37fbb7da949ea8068e6ca 214620 libafsauthent1_1.6.9-2+deb8u8_amd64.deb 4c036c80e271ca4789a2bd3f7bc21d2c6d73e0c77d050b7137abae1cc795133f 199780 libafsrpc1_1.6.9-2+deb8u8_amd64.deb bfa84fc2dabf5a26e8264327abc53d3f46137079a90111f7da23c8c147df5f57 1304994 libopenafs-dev_1.6.9-2+deb8u8_amd64.deb a23cf5c3c43c355e144a3c0baecb8677d862468eb94f694f16f6c22a227028d7 1165196 openafs-modules-source_1.6.9-2+deb8u8_all.deb 1a9ccf8b410d9ff98eaa3f291c89c33b106f461ca575c1480ceb7ed1420e0119 941696 openafs-modules-dkms_1.6.9-2+deb8u8_all.deb 906206d842e7e00390ffb1550f2f8018ea3f36984e4394d524a002766c2280a2 188074 libpam-openafs-kaserver_1.6.9-2+deb8u8_amd64.deb be952766e0351f9b81f246b7c7265db8aa193fda7570d58990dd62958722cd98 21920420 openafs-dbg_1.6.9-2+deb8u8_amd64.deb Files: 54dd503101baff3ffc6815376d0e938f 4139 net optional openafs_1.6.9-2+deb8u8.dsc 3c43068d9b1fe6bc35b21e83e723d137 163080 net optional openafs_1.6.9-2+deb8u8.debian.tar.xz 5fb97f43e84290b1c9f474e0024a1621 1968102 net optional openafs-client_1.6.9-2+deb8u8_amd64.deb e3b0d9cdb652addbaded61e6ee2c3586 285970 net extra openafs-fuse_1.6.9-2+deb8u8_amd64.deb 399fa54afcba239806a672a503262602 200240 net extra openafs-kpasswd_1.6.9-2+deb8u8_amd64.deb fd7f117b15cf22b8fbf33a095475e147 1306864 net optional openafs-fileserver_1.6.9-2+deb8u8_amd64.deb d615aa4213c2b7e07f1f4e140f98fb80 452868 net optional openafs-dbserver_1.6.9-2+deb8u8_amd64.deb c952bfe56d71b6489b60f113ccf270b3 4000050 doc optional openafs-doc_1.6.9-2+deb8u8_all.deb 08a9c6d40d55627bad05b5795cceb81d 259122 net optional openafs-krb5_1.6.9-2+deb8u8_amd64.deb 1c7333366f2a977fec659bc0bb371b6b 91312 libs optional libkopenafs1_1.6.9-2+deb8u8_amd64.deb 60ff00dea4a426afdb4a64f5ba2915a1 214620 libs optional libafsauthent1_1.6.9-2+deb8u8_amd64.deb bdfaccb2f36b881e1e837f5dd78e5e96 199780 libs optional libafsrpc1_1.6.9-2+deb8u8_amd64.deb 2f821b73b0a46a3690c1c6dac7348517 1304994 libdevel extra libopenafs-dev_1.6.9-2+deb8u8_amd64.deb 80610e5cbb265ffb97541c866a24099a 1165196 kernel extra openafs-modules-source_1.6.9-2+deb8u8_all.deb 4691f35c61ebe44f934302027d056455 941696 kernel extra openafs-modules-dkms_1.6.9-2+deb8u8_all.deb 1e4e44cb88f8a18b48b1a663041b5a30 188074 admin extra libpam-openafs-kaserver_1.6.9-2+deb8u8_amd64.deb 866c6372bdbdef56f9a62e7e1b67ed0d 21920420 debug extra openafs-dbg_1.6.9-2+deb8u8_amd64.deb -----BEGIN PGP SIGNATURE----- iQKjBAEBCgCNFiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAlulIVxfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD RjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQPHGFwb0BkZWJp YW4ub3JnAAoJENmtFLlRO1HkzSQQAJCsip4msxFCX0AMIiuuqkDvvJ4C4sAE3HpR C+XSLdPnG4W3xFD30hxSziyvVJcpswfs4BKvdpTLjvO+yu3FsxY5/cA9Hi6BbB0S InxttYnqLHsEdlj8OacB0UclKbPqUxfW57AozmhzLY27LdqnU31bqfyHCJUy5/9t zTWlFMZFZDrxYiSsBTgA4KM6QBY3jz/htldKdzkKAjI/3RjBEjZSkcMZBJLPxtfw MOJpintScwnZdIrHr+nUzsEP71CndPGGsXhT+jEi5XXLHJzHlUJ37K9GFsb4oNuY cdIRLI9TsVnF9zG3+hhSOzet82KhRBcoDlaVgK1i0Wy/KmBTghYTTR7gl7h+aI46 aS8BaeDgi6gz+GJDjqoIs1ptWwyNVdUT+a/aq2JGddPEZjPzBKOx1xLpGYb5eN4q QbNNjFt9o5klzOuIKDbSab9BU8bqFTN4//hCPIhP2ql7kwuU7qX0Y0smKyokZdv8 orGo+fiYHUL2lJOLDTHfkBXbScvvmIcD507KRs8r23wiTwBJ/t9F5+BCeZYCzIw2 kLgXhU8V4jA0YN4uw85IDQTEv4XeBHHR3qh1IP14D5Vo0VFoKDM8qiroAJA6yUVP ZEdjjg/hwlxYZqTd3BL9VcWFo21XFxmoBy5dneVSgippO+QMUDeyf2c2UjktHRSG 9qCouHNX =Vg+p -----END PGP SIGNATURE-----
