CVE-2013-4134

Related Files

Mandriva Linux Security Advisory 2014-244

Posted Dec 15, 2014

Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2014-244 - Buffer overflow in certain client utilities in OpenAFS before 1.6.2 allows remote authenticated users to cause a denial of service and possibly execute arbitrary code via a long fileserver ACL entry. Integer overflow in ptserver in OpenAFS before 1.6.2 allows remote attackers to cause a denial of service via a large list from the IdToName RPC, which triggers a heap-based buffer overflow. OpenAFS before 1.4.15, 1.6.x before 1.6.5, and 1.7.x before 1.7.26 uses weak encryption for Kerberos keys, which makes it easier for remote attackers to obtain the service key. The vos command in OpenAFS 1.6.x before 1.6.5, when using the -encrypt option, only enables integrity protection and sends data in cleartext, which allows remote attackers to obtain sensitive information by sniffing the network. Buffer overflow in the GetStatistics64 remote procedure call in OpenAFS 1.4.8 before 1.6.7 allows remote attackers to cause a denial of service via a crafted statsVersion argument. A denial of service flaw was found in libxml2, a library providing support to read, modify and write XML and HTML files. A remote attacker could provide a specially crafted XML file that, when processed by an application using libxml2, would lead to excessive CPU consumption based on excessive entity substitutions, even if entity substitution was disabled, which is the parser default behavior. The updated packages have been upgraded to the 1.4.15 version and patched to correct these issues.

tags | advisory, remote, denial of service, overflow, arbitrary

systems | linux, mandriva

advisories | CVE-2013-1794, CVE-2013-1795, CVE-2013-4134, CVE-2013-4135, CVE-2014-0159

SHA-256 | f0ded20bf2adb359a6b497c84a94616df27c085b24333664b6ab70f9a03960e2

Download | Favorite | View

Gentoo Linux Security Advisory 201404-05

Posted Apr 7, 2014

Authored by Gentoo | Site security.gentoo.org

Gentoo Linux Security Advisory 201404-5 - Multiple vulnerabilities have been found in OpenAFS, worst of which can allow attackers to execute arbitrary code. Versions less than 1.6.5 are affected.

tags | advisory, arbitrary, vulnerability

systems | linux, gentoo

advisories | CVE-2009-1250, CVE-2009-1251, CVE-2011-0430, CVE-2011-0431, CVE-2013-1794, CVE-2013-1795, CVE-2013-4134, CVE-2013-4135

SHA-256 | bdd4ed6538ff78bf057d8dfb17d273d308bbeb4af917a10d1c972e171f1ca870

Download | Favorite | View

Debian Security Advisory 2729-1

Posted Jul 29, 2013

Authored by Debian | Site debian.org

Debian Linux Security Advisory 2729-1 - OpenAFS, the implementation of the distributed filesystem AFS, has been updated to no longer use DES for the encryption of tickets. Additional migration steps are needed to fully set the update into effect.

tags | advisory

systems | linux, debian

advisories | CVE-2013-4134, CVE-2013-4135

SHA-256 | 404afb222135a19aaf78a3b157d3a4a64ca33cccc96fb95da671c31764342699

Download | Favorite | View