OpenAFS Security Advisories

The following are overviews of security advisories issued by the OpenAFS Project regarding known security problems in OpenAFS and its components. Each overview includes a summary of the problem, a link to the full text of the advisory. When they are available, patches are also included. At the end of this document is a table of all OpenAFS security advisories.

If you want to report security problems or issues with OpenAFS, you may send mail to the OpenAFS security officer at security@openafs.org. When sending sensitive information, we ask that you encrypt it with PGP.


OPENAFS-SA-2014-001 - Denial of service attack against OpenAFS fileserver processes

Issued:9-Apr-2014
Last Update:9-Apr-2013
Affected: OpenAFS server versions 1.4.8 through 1.6.6. Also 1.6.8pre1.
Patch: http://www.openafs.org/security/openafs-sa-2014-001.patch
Full Text: http://www.openafs.org/security/OPENAFS-SA-2014-001.txt

An attacker with the ability to connect to an OpenAFS fileserver can trigger a buffer overflow, crashing the server.

OPENAFS-SA-2013-004 - vos -encrypt doesn't encrypt connection data

Issued:24-Jul-2013
Last Update:24-Jul-2013
Affected: OpenAFS client versions 1.6.1 through 1.6.4
Patch: http://www.openafs.org/security/openafs-sa-2013-004.patch
Full Text: http://www.openafs.org/security/OPENAFS-SA-2013-004.txt

An attacker can read data which an administrator expected to remain private.

OPENAFS-SA-2013-003 - Brute force DES attack permits compromise of AFS cell

Issued:24-Jul-2013
Last Update:24-Jul-2013
Affected: OpenAFS servers before versions 1.4.15 and 1.6.5
Instructions: How to rekey your cell
How to install rxkad k5 support for servers running OpenAFS 1.6
How to install rxkad k5 support for servers running OpenAFS 1.4
Full Text: http://www.openafs.org/security/OPENAFS-SA-2013-003.txt

The small size of the DES key space permits an attacker to brute force a cell's service key and then forge traffic from any user within the cell. The key space search can be performed in under 1 day at a cost of around $100 using publicly available services.

OPENAFS-SA-2013-002 - Buffer overflow in OpenAFS ptserver

Issued:27-Feb-2013
Last Update:27-Feb-2013
Affected: OpenAFS servers before version 1.6.2
Patch: http://www.openafs.org/security/openafs-sa-2013-002.patch
http://www.openafs.org/security/openafs-sa-2013-002-1_4_14_1.patch (for 1.4.14.1)
Full Text: http://www.openafs.org/security/OPENAFS-SA-2013-002.txt

An attacker can crash an OpenAFS ptserver by sending an IdToName RPC with a large payload. This vulnerability is being tracked as CVE-2013-1795.

OPENAFS-SA-2013-001 - Buffer overflows in OpenAFS fileserver

Issued:27-Feb-2013
Last Update:27-Feb-2013
Affected: OpenAFS servers before version 1.6.2
Patch: http://www.openafs.org/security/openafs-sa-2013-001.patch
http://www.openafs.org/security/openafs-sa-2013-001-1_4_14_1.patch (for 1.4.14.1)
Full Text: http://www.openafs.org/security/OPENAFS-SA-2013-001.txt

By carefully crafting an ACL entry an attacker may overflow fixed length buffers within the OpenAFS fileserver, crashing the fileserver, and potentially permitting the execution of arbitrary code. To perform the exploit, the attacker must already have permissions to create ACLs on the fileserver in question. This vulnerability is being tracked as CVE-2013-1794.

OPENAFS-SA-2011-001 - Denial of service attack against Rx server processes

Issued:23-Feb-2011
Last Update:23-Feb-2011
Affected: OpenAFS servers versions 1.2.8 - 1.4.12.1, 1.5.0-1.5.74 for all platforms
Full Text: http://www.openafs.org/security/OPENAFS-SA-2011-001.txt

An attacker with control of a client, or the ability to forge RX packets, can crash a server of affected hosts. This vulnerability is being tracked as CVE-2011-0430.

Currently the advisory erroneously states 1.4.14 is vulnerable.

CVE-2011-0431, while correctly describing 1.4.14 as containing the fix for this issue, describes in its summary the release as broken. It is not. We recommend sites upgrade to 1.4.14; However, the impact of the issue is limited to a denial of service attack by a user with the ability to affect a lock of AFS though the client on a host.

OPENAFS-SA-2009-002 - Denial of service attack against Linux cache manager

Issued:6-Apr-2009
Last Update:6-Apr-2009
Severity:Medium
Affected: OpenAFS 1.0-1.4.8, OpenAFS 1.5.0-1.5.58
Full Text: http://www.openafs.org/security/OPENAFS-SA-2009-002.txt

AFS may pass an error code obtained from the fileserver directly to the Linux kernel, using a Linux mechanism that merges error codes and pointers into a single value. However, this mechanism is unable to distinguish certain error codes from pointers. When AFS returns a code of this type to the kernel, the kernel treats it as a pointer and attempts to dereference it. This causes a kernel panic, and results in a denial of service attack.

There are no known publicly-available exploits for this vulnerability at this time.


OPENAFS-SA-2009-001 - Network based buffer overflow attack against Unix cache manager

Issued:6-Apr-2009
Last Update:6-Apr-2009
Severity:Medium
Affected: OpenAFS 1.0-1.4.8, OpenAFS 1.5.0-1.5.58
Full Text: http://www.openafs.org/security/OPENAFS-SA-2009-001.txt

AFS's XDR data marshalling language permits the construction of arrays with a size constrained by the interface definition. The XDR decoding language will accept data from the server up to this maximum size, which in some cases is stored into a buffer allocated by the client. In several locations, the AFS client assumes that the server will never return more data than requested, and so allocates a buffer smaller than this maximum size. Whilst this causes no problems when communicating with valid servers, an attacker can return more data than expected, and overflow the client's buffer.

There are no known publicly-available exploits for this vulnerability at this time.


OPENAFS-SA-2007-003 - denial of service in OpenAFS fileserver

Issued:20-Dec-2007
Last Update:21-Dec-2007
Severity:Medium
Affected: OpenAFS 1.3.50-1.4.5, OpenAFS 1.5.0-1.5.27
Full Text: http://www.openafs.org/security/OPENAFS-SA-2007-003.txt

The AFS fileserver tracks client callbacks on files via a series of linked lists internally. When a client acquires a new callback or gives up an old one, these lists must be updated. Beginning in 1.3.50, a bulk disposal mechanism was added. Due to a failure to hold a lock, unsafe access to data could result in a crash. No data compromise is known.

There are no known publicly-available exploits for this vulnerability at this time.


OPENAFS-SA-2007-002 - OpenAFS for Windows clients denial of service vulnerability

Issued:19-Apr-2007
Last Update:19-Apr-2007
Severity:Medium
Affected: OpenAFS 1.3.64-1.3.99, OpenAFS 1.4.0-1.4.4, OpenAFS 1.5.0-1.5.18
Full Text: http://www.openafs.org/security/OPENAFS-SA-2007-002.txt

OpenAFS for Windows installs a Network Provider module, afslogon.dll, which is loaded by the Windows Logon service, winlogon.exe. When MIT Kerberos for Windows is installed, afslogon.dll will attempt to perform operations that involve the Kerberos v5 libraries. Successful use of Kerberos v5 requires the ability to establish a krb5_context. Parsing errors in the Kerberos v5 configuration profile, krb5.ini, will prevent the successful creation of a krb5_context. afslogon.dll attempts to free a krb5_context whether or not it was successfully established. This produces a memory access error that in turn forces the Windows Logon Service to terminate unexpectedly and causes Microsoft Windows to halt.

There are no known publicly-available exploits for this vulnerability at this time.


OPENAFS-SA-2007-001 - setuid (privilege escalation) in OpenAFS Unix based clients

Issued:20-Mar-2007
Last Update:20-Mar-2007
Severity:Medium
Affected: OpenAFS 1.0-1.4.3, OpenAFS 1.5.0-1.5.16
Full Text: http://www.openafs.org/security/OPENAFS-SA-2007-001.txt

Because AFS cache managers do not use authenticated connections for non-user-authenticated sessions, checks for cache coherency are done over an unprotected connection if they are not being done for an authenticated user. Because of this it is possible to spoof a false status for files in the cache.

The AFS cache manager on platforms which offer privilege based on file modes are vulnerable to such attacks.

There are no known publicly-available exploits for this vulnerability at this time.


OPENAFS-SA-2003-002 - Rx connection hijacking vulnerability

Issued:18-Apr-2003
Last Update:18-Apr-2003
Severity:Medium
Affected: OpenAFS 1.0-1.2.7, OpenAFS 1.3.0-1.3.2
Full Text: http://www.openafs.org/security/OPENAFS-SA-2003-002.txt
Patch: http://www.openafs.org/security/openafs-sa-2003-002.patch (PGP signature)

There is a bug in the Rx RPC protocol, used by AFS, which can be exploited by an attacker to hijack arbitrary Rx connections. This allows the attacker to mount a denial of service attack by breaking arbitrary Rx connections. Additionally, unless encryption is used, such as rxkad mode crypt ("fs setcrypt on") and the user accessing files is authenticated (has valid tokens), the attacker can observe and modify the data being transferred.

The AFS cache manager and other AFS administrative clients (such as pts, fs, vos, etc) are vulnerable to these attacks. Vulnerable AFS servers allow connections from AFS cache managers to be hijacked, but not connections from the other AFS administrative clients (such as pts, fs, vos, etc).

There are no known publicly-available exploits for this vulnerability at this time.


OPENAFS-SA-2003-001 - Cryptographic weakness in Kerberos v4

Issued:25-Mar-2003
Last Update:25-Mar-2003
Severity:High
Affected: OpenAFS 1.0-1.2.8, OpenAFS 1.3.0-1.3.2
Full Text: http://www.openafs.org/security/OPENAFS-SA-2003-001.txt
Patch: http://www.openafs.org/security/kaserver-disable-krb4-crossrealm-20030317.delta (PGP signature)

A cryptographic weakness in version 4 of the Kerberos protocol allows an attacker to use a chosen-plaintext attack to impersonate any principal in a realm. OpenAFS kaserver implements version 4 of the Kerberos protocol, and therefore is vulnerable. An attacker that knows a shared cross-realm key between any remote realm and the local realm can impersonate any principal in the local realm to AFS database servers and file servers in the local cell, and other services in the local realm. An attacker that can create arbitrary principal names in a realm can also impersonate any principal in that realm.

If your realm has no shared keys, and does not allow users to create arbitrary principal names, you are not exposed to this vulnerability.

There are no known publicly-available exploits for this vulnerability at this time.


OPENAFS-SA-2002-001 - xdr_array integer overflow

Issued:03-Aug-2002
Last Update:03-Aug-2002
Severity:High
Affected: OpenAFS 1.0-1.2.5, OpenAFS 1.3.0-1.3.2
Full Text: http://www.openafs.org/security/OPENAFS-SA-2002-001.txt
Patch: http://www.openafs.org/security/xdr-updates-20020731.delta (PGP signature)

There is an integer overflow bug in the SUNRPC-derived RPC library used by OpenAFS that could be exploited to crash certain OpenAFS servers (volserver, vlserver, ptserver, buserver) or to obtain unauthorized root access to a host running one of these processes.

In addition, it is possible for a rogue server to attack certain administrative clients (vos, pts, backup, butc, rxstat), but only if certain RPC requests are made to the rogue server.

The OpenAFS fileserver and cache manager (client) are not vulnerable to these attacks. No exploits are presently known to be available for this vulnerability.


Overview of all OpenAFS Security Advisories

IDIssuedUpdated SeverityVersions Affectedtopic
2002-00103-Aug-200203-Aug-2002 High1.0-1.2.5, 1.3.0-1.3.2 xdr_array integer overflow
2003-00125-Mar-200325-Mar-2003 High1.0-1.2.8, 1.3.0-1.3.2 Cryptographic weakness in Kerberos v4
2003-00218-Apr-200318-Apr-2003 Medium1.0-1.2.7, 1.3.0-1.3.2 Rx connection hijacking vulnerability
2007-00120-Mar-200720-Mar-2007 Medium1.0-1.4.3, 1.5.0-1.5.16 setuid (privilege escalation) in OpenAFS Unix based clients
2007-00219-Apr-200719-Apr-2007 Medium1.3.64-1.4.4, 1.5.0-1.5.18 OpenAFS for Windows clients denial of service vulnerability
2007-00320-Dec-200721-Dec-2007 Medium1.3.50-1.4.5, 1.5.0-1.5.27 denial of service in OpenAFS fileserver
2009-00106-Apr-200906-Apr-2009 Medium1.0-1.4.8, 1.5.0-1.5.58 Network based buffer overflow attack against Unix cache manager
2009-00206-Apr-200906-Apr-2009 Medium1.0-1.4.8, 1.5.0-1.5.58 Denial of service attack against Linux cache manager
2011-00123-Feb-201123-Feb-2011 Medium1.2.8-1.4.12.1, 1.5.0-1.5.74 Denial of service attack against Rx server processes
2013-00127-Feb-201327-Feb-2013 High1.0-1.6.1 Buffer overflows in OpenAFS fileserver
2013-00227-Feb-201327-Feb-2013 High1.0-1.6.1 Buffer overflow in OpenAFS ptserver
2013-00324-Jul-201324-Jul-2013 High1.0-1.4.14,1.5.0-1.6.4 Brute force DES attack permits compromise of AFS cell
2013-00424-Jul-201324-Jul-2013 High1.6.1-1.6.4 vos -encrypt doesn't encrypt connection data
2013-0049-Apr-20139-Apr-2014 High1.4.8-1.6.6 vos -encrypt doesn't encrypt connection data