[Security Announce] [ MDKSA-2007:066 ] - Updated OpenAFS packages address vulnerability

Posted by Bob on: 03/21/2007 02:10 AM [ Print | 0 comment(s) ]

The Mandriva Security Team published a new security update for Mandriva Linux. Here the announcement:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDKSA-2007:066
http://www.mandriva.com/security/
_______________________________________________________________________

Package : openafs
Date : March 20, 2007
Affected: 2007.0
_______________________________________________________________________

Problem Description:

By default, OpenAFS prior to 1.44 and 1.5.17 supports setuid programs
within the local cell, which could allow attackers to obtain privileges.

Updated packages have been patched to address this issue.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1507
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2007.0:
5f245149a0f7d9c654811a8100ac4c99 2007.0/i586/dkms-libafs-1.4.1-5.1mdv2007.0.i586.rpm
e95bfb0a96395b0bf76779928e809fb6 2007.0/i586/libopenafs1-1.4.1-5.1mdv2007.0.i586.rpm
f9823ac9d6335867ea5e7db6297f76c3 2007.0/i586/libopenafs1-devel-1.4.1-5.1mdv2007.0.i586.rpm
513203c9f79e10d45a428947b3968671 2007.0/i586/openafs-1.4.1-5.1mdv2007.0.i586.rpm
fefbc3291e162c2271b252c561ec4ac8 2007.0/i586/openafs-client-1.4.1-5.1mdv2007.0.i586.rpm
712c5a6b3d033e68a1dcec75b89d4991 2007.0/i586/openafs-doc-1.4.1-5.1mdv2007.0.i586.rpm
34de4c3b5ca22e8ca8e9d76cbf5c4d70 2007.0/i586/openafs-server-1.4.1-5.1mdv2007.0.i586.rpm
389e28512334f66a0d44c8cf3878c7bb 2007.0/SRPMS/openafs-1.4.1-5.1mdv2007.0.src.rpm

Mandriva Linux 2007.0/X86_64:
528117bf510ff2c31690d82817794c97 2007.0/x86_64/dkms-libafs-1.4.1-5.1mdv2007.0.x86_64.rpm
e6e5804b57822d0be27e1340383f82ae 2007.0/x86_64/lib64openafs1-1.4.1-5.1mdv2007.0.x86_64.rpm
3fe146dc10eba896fb96c30ed3343452 2007.0/x86_64/lib64openafs1-devel-1.4.1-5.1mdv2007.0.x86_64.rpm
b4da48079d79eed91dc709247cf1feeb 2007.0/x86_64/openafs-1.4.1-5.1mdv2007.0.x86_64.rpm
e6b6ed613f90960c2b231eee920ec92a 2007.0/x86_64/openafs-client-1.4.1-5.1mdv2007.0.x86_64.rpm
b3721d7cef3df8173b89c422687a85ff 2007.0/x86_64/openafs-doc-1.4.1-5.1mdv2007.0.x86_64.rpm
58b999c155164afe426cd6cc76e93e06 2007.0/x86_64/openafs-server-1.4.1-5.1mdv2007.0.x86_64.rpm
389e28512334f66a0d44c8cf3878c7bb 2007.0/SRPMS/openafs-1.4.1-5.1mdv2007.0.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
lt;security*mandriva.comgt;
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)

iD8DBQFGAE48mqjQ0CJFipgRAtjGAKCHL8YwKgqLVP10p/SVzNILA4qllgCgp6MB
MD5PxxM8FqQ6W2S9zpUn6O4=
=Sz3I
-----END PGP SIGNATURE-----