OpenAFS: Arbitrary code execution

OpenAFS: Arbitrary code execution The cache manager of OpenAFS contains several bugs resulting in remote execution of arbitrary code. OpenAFS January 16, 2011 January 16, 2011: 01 265538 remote 1.4.9 1.4.9

OpenAFS is a distributed file system.

Two vulnerabilities were discovered:

Simon Wilkinson discovered from a bug report by Toby Blake that the cache manager of OpenAFS contains a heap-based buffer overflow which is related to the use of the ERR_PTR macro (CVE-2009-1250).
A pointer dereference bug when using XDR arrays was discovered by Simon Wilkinson, with assistance from Derrick Brashear and Jeffrey Altman. (CVE-2009-1251).

The vulnerabilities might allow remote unauthenticated attackers to cause a Denial of Service (system crash) and possibly execute arbitrary code.

There is no known workaround at this time.

All OpenAFS users should upgrade to the latest version:


    # emerge --sync
    # emerge --ask --oneshot --verbose ">=net-fs/openafs-1.4.9"

CVE-2009-1250 CVE-2009-1251 craig p-y