This bug was fixed in the package openafs - 1.6.2-1+ubuntu2.1
---------------
openafs (1.6.2-1+ubuntu2.1) raring-security; urgency=low
* SECURITY UPDATE: Brute force DES attack permits compromise of AFS cell.
- 0001-Add-rxkad-server-hook-function-to-decrypt-more-types.patch
- 0002-New-optional-rxkad-functionality-for-decypting-krb5-.patch
- 0003-Integrate-keytab-based-decryption-into-afsconf_Build.patch
- 0004-Derive-DES-fcrypt-session-key-from-other-key-types.patch
- 0005-Move-akimpersonate-to-libauth.patch
- 0006-Clean-up-akimpersonate-and-use-for-server-to-server.patch
- 0007-auth-Do-not-always-fallback-to-noauth.patch
- 0008-Avoid-calling-afsconf_GetLatestKey-directly.patch
- 0009-Reload-rxkad.keytab-on-CellServDB-modification.patch
- 0010-Add-support-for-deriving-DES-keys-to-klog.krb5.patch
- 0011 skipped because it was a version bump
- 0012-ubik-Fix-encryption-selection-in-ugen.patch
- Thanks to Chaskiel Grundman, Alexander Chernyakhovsky, Ben Kaduk,
Andrew Deason, and Michael Meffie for the above patch series.
- swap-libs.patch: Resolve FTBFS with newer toolchains. Thanks to Anders
Kaseorg.
- OPENAFS-SA-2013-003
- OPENAFS-SA-2013-004
- CVE-2013-4134
- CVE-2013-4135
- LP: #1204195
-- Luke Faraone <[email protected]> Tue, 23 Jul 2013 21:25:03 -0400
** Changed in: openafs (Ubuntu Raring)
Status: Confirmed => Fix Released
** Changed in: openafs (Ubuntu Quantal)
Status: Confirmed => Fix Released
** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2013-1794
** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2013-1795
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1204195
Title:
OpenAFS Security Advisories 2013-0003 and 2013-0004
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openafs/+bug/1204195/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
