Openafs has a security hole with enabled suid

[Stephan Wienczny]

Binary package hint: openafs-client

Openafs has a privilege escalation security hole that permits an attacker to gain local root access.

A security adversory can be found upstream at http://openafs.org/security/OPENAFS-SA-2007-001.txt
A new openafs-release fixes this.

[Kees Cook (kees)]

Thanks for the report. I've linked to the CVE for this. If someone can prepare debdiffs and test them, I can get them published.

[Björn Torkelsson (torkel)]

Debdiff against the version in Dapper. The package built without any problem, however I have at the moment no way to test it. The fix is trivial though and should also apply to the versions in breezy and edgy.

Russ Allbery said he will try to package 1.4.4 for Debian Experimental this weekend. I really suggest that we try to get an UVF execption for that one for Feisty. 1.4.4 fixes a lot of problems in 1.4.2, and probably most important it works with 2.6.20. 1.4.2-4ubuntu1 has some of the upstream patches to make it work with 2.6.20, but I'm not sure that I found everything needed.

[Björn Torkelsson (torkel)]

UVF Execption for feisty to get Openafs 1.4.4 (requires a sync from Debian Experimental) in filed as #94787.

[Emilio Pozuelo Monfort (pochu)]

94787 is this bug ;) The UVFe is in Bug #96931

[Björn Torkelsson (torkel)]

Feisty got 1.4.4 so it is safe. But what happend to dapper and edgy? Did somebody test the debdiff?

[Achim Bohnet (allee)]

No. I'm using my dapper 1.4.4-x backports. Ditto for edgy but there are now all replace with feisty.
I trust upstream enough, to backports on dapper ... gutsy the new 1.4.* releases. Sorry, lame
excuse to not test it :(

[Russ Allbery (rra-debian)]

Fixed since feisty

[Marc Deslauriers (mdeslaur)]

This was released for dapper today.