• info
• discussion
• exploit
• solution
• references

OpenAFS FetchStatus Reply Privilege Escalation Vulnerability

Solution:
The vendor has released fixes to address these issues. Please see the references for more information.


OpenAFS OpenAFS 1.0

• OpenAFS OpenAFS Version 1.4.4
  http://www.openafs.org/release/latest.html.

OpenAFS OpenAFS 1.0.1

• OpenAFS OpenAFS Version 1.4.4
  http://www.openafs.org/release/latest.html.

OpenAFS OpenAFS 1.0.2

• OpenAFS OpenAFS Version 1.4.4
  http://www.openafs.org/release/latest.html.

OpenAFS OpenAFS 1.0.3

• OpenAFS OpenAFS Version 1.4.4
  http://www.openafs.org/release/latest.html.

OpenAFS OpenAFS 1.0.4 a

• OpenAFS OpenAFS Version 1.4.4
  http://www.openafs.org/release/latest.html.

OpenAFS OpenAFS 1.0.4

• OpenAFS OpenAFS Version 1.4.4
  http://www.openafs.org/release/latest.html.

OpenAFS OpenAFS 1.1

• OpenAFS OpenAFS Version 1.4.4
  http://www.openafs.org/release/latest.html.

OpenAFS OpenAFS 1.1.1 a

• OpenAFS OpenAFS Version 1.4.4
  http://www.openafs.org/release/latest.html.

OpenAFS OpenAFS 1.1.1

• OpenAFS OpenAFS Version 1.4.4
  http://www.openafs.org/release/latest.html.

OpenAFS OpenAFS 1.2

• OpenAFS OpenAFS Version 1.4.4
  http://www.openafs.org/release/latest.html.

OpenAFS OpenAFS 1.2.1

• OpenAFS OpenAFS Version 1.4.4
  http://www.openafs.org/release/latest.html.

OpenAFS OpenAFS 1.2.2

• OpenAFS OpenAFS Version 1.4.4
  http://www.openafs.org/release/latest.html.

OpenAFS OpenAFS 1.2.2 b

• OpenAFS OpenAFS Version 1.4.4
  http://www.openafs.org/release/latest.html.

OpenAFS OpenAFS 1.2.2 a

• OpenAFS OpenAFS Version 1.4.4
  http://www.openafs.org/release/latest.html.

OpenAFS OpenAFS 1.2.3

• OpenAFS OpenAFS Version 1.4.4
  http://www.openafs.org/release/latest.html.

OpenAFS OpenAFS 1.2.4

• OpenAFS OpenAFS Version 1.4.4
  http://www.openafs.org/release/latest.html.

OpenAFS OpenAFS 1.2.5

• OpenAFS OpenAFS Version 1.4.4
  http://www.openafs.org/release/latest.html.

OpenAFS OpenAFS 1.2.6

• OpenAFS OpenAFS Version 1.4.4
  http://www.openafs.org/release/latest.html.

OpenAFS OpenAFS 1.2.7

• OpenAFS OpenAFS Version 1.4.4
  http://www.openafs.org/release/latest.html.

OpenAFS OpenAFS 1.2.8

• OpenAFS OpenAFS Version 1.4.4
  http://www.openafs.org/release/latest.html.

OpenAFS OpenAFS 1.2.9

• OpenAFS OpenAFS Version 1.4.4
  http://www.openafs.org/release/latest.html.

OpenAFS OpenAFS 1.3

• OpenAFS OpenAFS Version 1.4.4
  http://www.openafs.org/release/latest.html.

OpenAFS OpenAFS 1.3.1

• OpenAFS OpenAFS Version 1.4.4
  http://www.openafs.org/release/latest.html.

OpenAFS OpenAFS 1.3.2

• OpenAFS OpenAFS Version 1.4.4
  http://www.openafs.org/release/latest.html.

OpenAFS OpenAFS 1.3.81

• Debian libopenafs-dev_1.3.81-3sarge2_alpha.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/libopenafs-dev_ 1.3.81-3sarge2_alpha.deb


• Debian libopenafs-dev_1.3.81-3sarge2_amd64.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/libopenafs-dev_ 1.3.81-3sarge2_amd64.deb


• Debian libopenafs-dev_1.3.81-3sarge2_hppa.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/libopenafs-dev_ 1.3.81-3sarge2_hppa.deb


• Debian libopenafs-dev_1.3.81-3sarge2_i386.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/libopenafs-dev_ 1.3.81-3sarge2_i386.deb


• Debian libopenafs-dev_1.3.81-3sarge2_ia64.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/libopenafs-dev_ 1.3.81-3sarge2_ia64.deb


• Debian libopenafs-dev_1.3.81-3sarge2_powerpc.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/libopenafs-dev_ 1.3.81-3sarge2_powerpc.deb


• Debian libopenafs-dev_1.3.81-3sarge2_s390.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/libopenafs-dev_ 1.3.81-3sarge2_s390.deb


• Debian libopenafs-dev_1.3.81-3sarge2_sparc.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/libopenafs-dev_ 1.3.81-3sarge2_sparc.deb


• Debian libpam-openafs-kaserver_1.3.81-3sarge2_alpha.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/libpam-openafs- kaserver_1.3.81-3sarge2_alpha.deb


• Debian libpam-openafs-kaserver_1.3.81-3sarge2_amd64.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/libpam-openafs- kaserver_1.3.81-3sarge2_amd64.deb


• Debian libpam-openafs-kaserver_1.3.81-3sarge2_hppa.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/libpam-openafs- kaserver_1.3.81-3sarge2_hppa.deb


• Debian libpam-openafs-kaserver_1.3.81-3sarge2_i386.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/libpam-openafs- kaserver_1.3.81-3sarge2_i386.deb


• Debian libpam-openafs-kaserver_1.3.81-3sarge2_ia64.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/libpam-openafs- kaserver_1.3.81-3sarge2_ia64.deb


• Debian libpam-openafs-kaserver_1.3.81-3sarge2_powerpc.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/libpam-openafs- kaserver_1.3.81-3sarge2_powerpc.deb


• Debian libpam-openafs-kaserver_1.3.81-3sarge2_s390.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/libpam-openafs- kaserver_1.3.81-3sarge2_s390.deb


• Debian libpam-openafs-kaserver_1.3.81-3sarge2_sparc.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/libpam-openafs- kaserver_1.3.81-3sarge2_sparc.deb


• Debian openafs-client_1.3.81-3sarge2_alpha.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/openafs-client_ 1.3.81-3sarge2_alpha.deb


• Debian openafs-client_1.3.81-3sarge2_amd64.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/openafs-client_ 1.3.81-3sarge2_amd64.deb


• Debian openafs-client_1.3.81-3sarge2_hppa.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/openafs-client_ 1.3.81-3sarge2_hppa.deb


• Debian openafs-client_1.3.81-3sarge2_i386.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/openafs-client_ 1.3.81-3sarge2_i386.deb


• Debian openafs-client_1.3.81-3sarge2_ia64.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/openafs-client_ 1.3.81-3sarge2_ia64.deb


• Debian openafs-client_1.3.81-3sarge2_powerpc.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/openafs-client_ 1.3.81-3sarge2_powerpc.deb


• Debian openafs-client_1.3.81-3sarge2_s390.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/openafs-client_ 1.3.81-3sarge2_s390.deb


• Debian openafs-client_1.3.81-3sarge2_sparc.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/openafs-client_ 1.3.81-3sarge2_sparc.deb


• Debian openafs-dbserver_1.3.81-3sarge2_alpha.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/openafs-dbserve r_1.3.81-3sarge2_alpha.deb


• Debian openafs-dbserver_1.3.81-3sarge2_amd64.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/openafs-dbserve r_1.3.81-3sarge2_amd64.deb


• Debian openafs-dbserver_1.3.81-3sarge2_hppa.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/openafs-dbserve r_1.3.81-3sarge2_hppa.deb


• Debian openafs-dbserver_1.3.81-3sarge2_i386.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/openafs-dbserve r_1.3.81-3sarge2_i386.deb


• Debian openafs-dbserver_1.3.81-3sarge2_ia64.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/openafs-dbserve r_1.3.81-3sarge2_ia64.deb


• Debian openafs-dbserver_1.3.81-3sarge2_powerpc.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/openafs-dbserve r_1.3.81-3sarge2_powerpc.deb


• Debian openafs-dbserver_1.3.81-3sarge2_s390.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/openafs-dbserve r_1.3.81-3sarge2_s390.deb


• Debian openafs-dbserver_1.3.81-3sarge2_sparc.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/openafs-dbserve r_1.3.81-3sarge2_sparc.deb


• Debian openafs-fileserver_1.3.81-3sarge2_alpha.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/openafs-fileser ver_1.3.81-3sarge2_alpha.deb


• Debian openafs-fileserver_1.3.81-3sarge2_amd64.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/openafs-fileser ver_1.3.81-3sarge2_amd64.deb


• Debian openafs-fileserver_1.3.81-3sarge2_hppa.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/openafs-fileser ver_1.3.81-3sarge2_hppa.deb


• Debian openafs-fileserver_1.3.81-3sarge2_i386.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/openafs-fileser ver_1.3.81-3sarge2_i386.deb


• Debian openafs-fileserver_1.3.81-3sarge2_ia64.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/openafs-fileser ver_1.3.81-3sarge2_ia64.deb


• Debian openafs-fileserver_1.3.81-3sarge2_powerpc.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/openafs-fileser ver_1.3.81-3sarge2_powerpc.deb


• Debian openafs-fileserver_1.3.81-3sarge2_s390.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/openafs-fileser ver_1.3.81-3sarge2_s390.deb


• Debian openafs-fileserver_1.3.81-3sarge2_sparc.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/openafs-fileser ver_1.3.81-3sarge2_sparc.deb


• Debian openafs-kpasswd_1.3.81-3sarge2_alpha.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/openafs-kpasswd _1.3.81-3sarge2_alpha.deb


• Debian openafs-kpasswd_1.3.81-3sarge2_amd64.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/openafs-kpasswd _1.3.81-3sarge2_amd64.deb


• Debian openafs-kpasswd_1.3.81-3sarge2_hppa.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/openafs-kpasswd _1.3.81-3sarge2_hppa.deb


• Debian openafs-kpasswd_1.3.81-3sarge2_i386.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/openafs-kpasswd _1.3.81-3sarge2_i386.deb


• Debian openafs-kpasswd_1.3.81-3sarge2_ia64.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/openafs-kpasswd _1.3.81-3sarge2_ia64.deb


• Debian openafs-kpasswd_1.3.81-3sarge2_powerpc.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/openafs-kpasswd _1.3.81-3sarge2_powerpc.deb


• Debian openafs-kpasswd_1.3.81-3sarge2_s390.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/openafs-kpasswd _1.3.81-3sarge2_s390.deb


• Debian openafs-kpasswd_1.3.81-3sarge2_sparc.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/openafs-kpasswd _1.3.81-3sarge2_sparc.deb


• Debian openafs-modules-source_1.3.81-3sarge2_all.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/o/openafs/openafs-modules -source_1.3.81-3sarge2_all.deb

OpenAFS OpenAFS 1.4.3

• OpenAFS OpenAFS Version 1.4.4
  http://www.openafs.org/release/latest.html.

OpenAFS OpenAFS 1.5

• OpenAFS OpenAFS Version 1.4.4
  http://www.openafs.org/release/latest.html.

OpenAFS OpenAFS 1.5.16

• OpenAFS OpenAFS Version 1.4.4
  http://www.openafs.org/release/latest.html.