[ GLSA 200801-04 ] OpenAFS: Denial of Service

[GLSA]

Gentoo Linux Security Advisory

Title: OpenAFS: Denial of Service (GLSA 200801-04)
Severity: normal
Exploitable: remote
Date: January 09, 2008
Bug(s): #203573
ID: 200801-04

Synopsis

A Denial of Service vulnerability has been discovered in OpenAFS.

Background

OpenAFS is a distributed network filesystem.

Affected Packages

Package: net-fs/openafs
Vulnerable: < 1.4.6
Unaffected: >= 1.4.6
Architectures: All supported architectures


Description

Russ Allbery, Jeffrey Altman, Dan Hyde and Thomas Mueller discovered a race condition due to an improper handling of the clients callbacks lists.

Impact

A remote attacker could construct cases which trigger the race condition, resulting in a server crash.

Workaround

There is no known workaround at this time.

Resolution

All OpenAFS users should upgrade to the latest version: