Test ID:	1.3.6.1.4.1.25623.1.0.130049
Category:	Mageia Linux Local Security Checks
Title:	Mageia: Security Advisory (MGASA-2015-0337)
Summary:	The remote host is missing an update for the 'openafs' package(s) announced via the MGASA-2015-0337 advisory.
Description:	Summary: The remote host is missing an update for the 'openafs' package(s) announced via the MGASA-2015-0337 advisory. Vulnerability Insight: Updated openafs packages fix security vulnerabilities: Memory allocated by vos for VLDB entry structures was not cleared prior to use, meaning stack data could be sent over the network, possibly in the clear if crypt mode was not in use (CVE-2015-3282). The default use by bos of clear rather than crypt mode can allow spoofing commands, including some which modify server state if restricted mode was not enabled (CVE-2015-3283). A local user executing commands which make pioctl calls to the kernel will have some contents of kernel memory leaked when buffers used are larger than data being returned (CVE-2015-3284). A local user executing the OSD FS command pioctl can trigger a panic due to an incorrect buffer being used for return status of the command (CVE-2015-3285). The vlserver allows pattern matching on volume names via regular expressions when listing attributes. Because the regular expression is not checked for situations which can overflow the buffers used, an attack is possible which reads arbitrary memory beyond the end of the buffer and can act on it as part of the expression evaluation, potentially crashing the process (CVE-2015-6587). Affected Software/OS: 'openafs' package(s) on Mageia 4, Mageia 5. Solution: Please install the updated package(s). CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2015-3282 Debian Security Information: DSA-3320 (Google Search) http://www.debian.org/security/2015/dsa-3320 https://lists.openafs.org/pipermail/openafs-announce/2015/000486.html http://www.securitytracker.com/id/1033262 Common Vulnerability Exposure (CVE) ID: CVE-2015-3283 Common Vulnerability Exposure (CVE) ID: CVE-2015-3284 Common Vulnerability Exposure (CVE) ID: CVE-2015-3285 Common Vulnerability Exposure (CVE) ID: CVE-2015-6587
Copyright	Copyright (C) 2015 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.