[OpenAFS-devel] OpenAFS Security Releases 1.8.2, 1.6.23 available

[Benjamin Kaduk]

--n8g4imXOkfNTN/H1
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline


The OpenAFS Guardians are happy to announce the availability of
Security Releases OpenAFS 1.8.2 and 1.6.23.
Source files can be accessed via the web at:

       https://www.openafs.org/release/openafs-1.8.2.html
       https://www.openafs.org/release/openafs-1.6.23.html

or via AFS at:

       UNIX: /afs/grand.central.org/software/openafs/1.8.2/
       UNC: \\afs\grand.central.org\software\openafs\1.8.2\
       UNIX: /afs/grand.central.org/software/openafs/1.6.23/
       UNC: \\afs\grand.central.org\software\openafs\1.6.23\

These releases include fixes for three security advisories,
OPENAFS-SA-2018-001, OPENAFS-SA-2018-002, and OPENAFS-SA-2018-003.

OPENAFS-SA-2018-001 only affects deployments that run the 'butc' utility
as part of the in-tree backup system, but is of high severity for
those sites which are affected -- an anonymous attacker could replace
entire volumes with attacker-controlled contents.

OPENAFS-SA-2018-002 is for information leakage over the network via
uninitialized RPC output variables.  A number of RPCs are affected,
some of which require the caller to be authenticated, but in some cases
hundreds of bytes of data can be leaked per call.  Of note is that
cache managers are also subject to (kernel) memory leakage via
AFSCB_ RPCs.

OPENAFS-SA-2018-003 is a denial of service whereby anonymous attackers
can cause server processes to consume large quantities of memory for
a sustained period of time.

Please see the release notes and security advisories for additional details.

The changes to fix OPENAFS-SA-2018-001 require behavior change in both
butc(8) and backup(8) to use authenticated connections; old and new
versions of these utilities will not interoperate absent specific
configuration of the new tool to use the old (insecure) behavior.
These changes also are expected to cause backup(8)'s interactive mode
to be limited to only butc connections requiring (or not requiring)
authentication within a given interactive session, based on the initial
arguments selected.

Bug reports should be filed to openafs-bugs@openafs.org.

Benjamin Kaduk
for the OpenAFS Guardians

--n8g4imXOkfNTN/H1
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQG3BAABCgAdFiEE2WGV4E2ARf9BYP0XKNmm82TrdRIFAluYEdUACgkQKNmm82Tr
dRIWbAweKo4vV8PlQL+GU7F3KeRgb7OOl0DiZXVtOTaE6YaRQ+3nnWB4Wzsql+D4
6Gej//6yOHgDveZrjheT1OBcLU6AQFZhf2iRkmqsW0eHeA1Mqj0ErrxO8QxFTQ0A
A18zo18p85PmQr1zWaNAemuTCxk0Gv+RfD/r3xcmQ1vjKPfDcEOVb3q60vK/gFb6
MpzuQZ5XTEASJLsms/EEPoZRvgty82dkILbJEdeF144MGHzhhPivDjR00bQCXsuL
6euurQzqMMtPp4pRzmVFwvGhnUg/6G5Fe8J9et7fCkoMQZBt8d4taOpi4EUm8xr1
FMqureFJs/7dFWNKPeHwzbGWTO/+5XNMFR5yEcfaclt2tTqHBFFLdY1GeYsYH5iF
jxuCjvNDc7H+F4dzRGdLHlcZkNUOJcrrAglgqKXFadTORiqKN8OvQ2J+CA503W9c
55WZ5/14iMfdmppdS09215ENtIqlmpkHsU+ea5iUuy2+FOcGAWdwcM6+BRV1bX40
EM9mOVATItoJQA==
=8jXh
-----END PGP SIGNATURE-----

--n8g4imXOkfNTN/H1--