Home > Security > Advisories

Advisories

Mandriva Advisories

Package name openafs
Date March 20th, 2007
Advisory ID MDKSA-2007:066
Affected versions 2007.0
Synopsis Updated OpenAFS packages address vulnerability

Problem Description

By default, OpenAFS prior to 1.44 and 1.5.17 supports setuid programs
within the local cell, which could allow attackers to obtain privileges.

Updated packages have been patched to address this issue.

Updated Packages

Mandriva Linux 2007

 5f245149a0f7d9c654811a8100ac4c99  2007.0/i586/dkms-libafs-1.4.1-5.1mdv2007.0.i586.rpm
 e95bfb0a96395b0bf76779928e809fb6  2007.0/i586/libopenafs1-1.4.1-5.1mdv2007.0.i586.rpm
 f9823ac9d6335867ea5e7db6297f76c3  2007.0/i586/libopenafs1-devel-1.4.1-5.1mdv2007.0.i586.rpm
 513203c9f79e10d45a428947b3968671  2007.0/i586/openafs-1.4.1-5.1mdv2007.0.i586.rpm
 fefbc3291e162c2271b252c561ec4ac8  2007.0/i586/openafs-client-1.4.1-5.1mdv2007.0.i586.rpm
 712c5a6b3d033e68a1dcec75b89d4991  2007.0/i586/openafs-doc-1.4.1-5.1mdv2007.0.i586.rpm
 34de4c3b5ca22e8ca8e9d76cbf5c4d70  2007.0/i586/openafs-server-1.4.1-5.1mdv2007.0.i586.rpm 
 389e28512334f66a0d44c8cf3878c7bb  2007.0/SRPMS/openafs-1.4.1-5.1mdv2007.0.src.rpm

Mandriva Linux 2007/X86_64

 528117bf510ff2c31690d82817794c97  2007.0/x86_64/dkms-libafs-1.4.1-5.1mdv2007.0.x86_64.rpm
 e6e5804b57822d0be27e1340383f82ae  2007.0/x86_64/lib64openafs1-1.4.1-5.1mdv2007.0.x86_64.rpm
 3fe146dc10eba896fb96c30ed3343452  2007.0/x86_64/lib64openafs1-devel-1.4.1-5.1mdv2007.0.x86_64.rpm
 b4da48079d79eed91dc709247cf1feeb  2007.0/x86_64/openafs-1.4.1-5.1mdv2007.0.x86_64.rpm
 e6b6ed613f90960c2b231eee920ec92a  2007.0/x86_64/openafs-client-1.4.1-5.1mdv2007.0.x86_64.rpm
 b3721d7cef3df8173b89c422687a85ff  2007.0/x86_64/openafs-doc-1.4.1-5.1mdv2007.0.x86_64.rpm
 58b999c155164afe426cd6cc76e93e06  2007.0/x86_64/openafs-server-1.4.1-5.1mdv2007.0.x86_64.rpm 
 389e28512334f66a0d44c8cf3878c7bb  2007.0/SRPMS/openafs-1.4.1-5.1mdv2007.0.src.rpm

References

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1507

Upgrade

To upgrade automatically, use MandrivaUpdate.


Verification

Please verify the update prior to upgrading to ensure the integrity of the downloaded package. You can do this with the command :

                rpm --checksig package.rpm

You can get the GPG public key of the Mandriva Security Team to verify the GPG signature of each RPM.

If you use MandrivaUpdate, the verification of md5 checksum and GPG signature is performed automatically for you.