Bug 203573 (CVE-2007-6599)

Summary:	net-fs/openafs < 1.4.6 Denial of Service (CVE-2007-6599)
Product:	Gentoo Security	Reporter:	Stefaan De Roeck (RETIRED) <stefaan>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor
Priority:	High
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://lists.openafs.org/pipermail/openafs-announce/2007/000220.html
Whiteboard:	B3 [glsa]
Package list:		Runtime testing required:	---

Description Stefaan De Roeck (RETIRED) gentoo-dev

2007-12-28 15:16:23 UTC

See the URL

I think this can be evaluated as a C3.

CVS logs indicate that only a few patches make the difference between 1.4.5 and 1.4.6, so I think fast stabilization is an option.

Comment 1 Pierre-Yves Rofes (RETIRED) gentoo-dev

2007-12-28 23:25:52 UTC

Thanks for the report Stefaan. However I don't see any specific condition to make the issue exploitable, so it would be more like a B3.
Arches, please test and mark stable net-fs/openafs-1.4.6. Target "alpha amd64 ppc ppc64 ~sparc x86"

Comment 2 Markus Meier gentoo-dev

2007-12-29 23:07:21 UTC

x86 stable

Comment 3 Peter Weller (RETIRED) gentoo-dev

2007-12-31 17:49:12 UTC

(In reply to comment #1)
> Thanks for the report Stefaan. However I don't see any specific condition to
> make the issue exploitable, so it would be more like a B3.
> Arches, please test and mark stable net-fs/openafs-1.4.6. Target "alpha amd64
> ppc ppc64 ~sparc x86"
> 

And net-fs/openafs-kernel-1.4.6.

Comment 4 Peter Weller (RETIRED) gentoo-dev

2007-12-31 19:04:05 UTC

amd64 done.

Comment 5 Joe Jezak (RETIRED) gentoo-dev

2008-01-01 16:47:41 UTC

Marked ppc/ppc64 stable.

Comment 6 Stefaan De Roeck (RETIRED) gentoo-dev

2008-01-02 14:10:37 UTC

Keyworded for alpha, closing bug.  Thanks, everybody!

Comment 7 Pierre-Yves Rofes (RETIRED) gentoo-dev

2008-01-02 14:39:24 UTC

Please do not close security bugs.
time for glsa decision. I tend to vote yes.

Comment 8 Lars Hartmann 2008-01-04 20:17:51 UTC

can someone please add "CVE-2007-6599" to the topic?
i dont have the permissions needed to do that

Comment 9 Robert Buchholz (RETIRED) gentoo-dev

2008-01-05 00:13:47 UTC

Voting YES, request filed.

Comment 10 Pierre-Yves Rofes (RETIRED) gentoo-dev

2008-01-09 22:02:38 UTC

GLSA 200801-04