[OpenAFS-announce] OpenAFS Security Advisory 2013-0004
Wed, 24 Jul 2013 15:05:53 +0100
OpenAFS Security Advisory 2013-0004
Topic: vos -encrypt doesn't encrypt connection data
Affected: All OpenAFS clients
The -encrypt option to the 'vos' volume management command should cause
it to encrypt all data between client and server. However, in versions =
OpenAFS later than 1.6.0, it has no effect, and data is transmitted with
integrity protection only. In all versions of OpenAFS, vos -encrypt has
no effect when combined with the -localauth option.
Information which should be encrypted on the wire is only integrity
protected. An attacker may read RPC's initiated by the 'vos' command
which the administrator expected to remain private.
All current releases of OpenAFS.
The OpenAFS project recommends that administrators upgrade to OpenAFS =
or later. For those sites unable, or unwilling, to upgrade to the 1.6 =
a final release in the 1.4 series, 1.4.15, is provided.
This issue was identified independently by Chaskiel M Grundman and =
Meffie. Patches were provided by Michael Meffie.