Openafs has a security hole with enabled suid

Bug #94787 reported by Stephan Wienczny on 2007-03-22
Affects Status Importance Assigned to Milestone
openafs (Ubuntu)
Declined for Edgy by Luca Falavigna
Declined for Feisty by Jamie Strandboge

Bug Description

Binary package hint: openafs-client

Openafs has a privilege escalation security hole that permits an attacker to gain local root access.

A security adversory can be found upstream at
A new openafs-release fixes this.

CVE References

Kees Cook (kees) wrote :

Thanks for the report. I've linked to the CVE for this. If someone can prepare debdiffs and test them, I can get them published.

Changed in openafs:
status: Unconfirmed → Confirmed
Björn Torkelsson (torkel) wrote :

Debdiff against the version in Dapper. The package built without any problem, however I have at the moment no way to test it. The fix is trivial though and should also apply to the versions in breezy and edgy.

Russ Allbery said he will try to package 1.4.4 for Debian Experimental this weekend. I really suggest that we try to get an UVF execption for that one for Feisty. 1.4.4 fixes a lot of problems in 1.4.2, and probably most important it works with 2.6.20. 1.4.2-4ubuntu1 has some of the upstream patches to make it work with 2.6.20, but I'm not sure that I found everything needed.

Björn Torkelsson (torkel) wrote :

UVF Execption for feisty to get Openafs 1.4.4 (requires a sync from Debian Experimental) in filed as #94787.

Emilio Pozuelo Monfort (pochu) wrote :

94787 is this bug ;) The UVFe is in Bug #96931

Björn Torkelsson (torkel) wrote :

Feisty got 1.4.4 so it is safe. But what happend to dapper and edgy? Did somebody test the debdiff?

Achim Bohnet (allee) wrote :

No. I'm using my dapper 1.4.4-x backports. Ditto for edgy but there are now all replace with feisty.
I trust upstream enough, to backports on dapper ... gutsy the new 1.4.* releases. Sorry, lame
excuse to not test it :(

Russ Allbery (rra-debian) wrote :

Fixed since feisty

Changed in openafs:
status: Confirmed → Fix Released
Changed in openafs:
status: New → Confirmed
Marc Deslauriers (mdeslaur) wrote :

This was released for dapper today.

Changed in openafs (Ubuntu Dapper):
status: Confirmed → Fix Released
To post a comment you must log in.
This report contains Public Security information  Edit
Everyone can see this security related information.

Other bug subscribers