製品・ソフトウェアに関する情報

JVN脆弱性詳細

OpenAFS の ptserver における整数オーバーフローの脆弱性

Title	OpenAFS の ptserver における整数オーバーフローの脆弱性
Summary	OpenAFS の ptserver には、整数オーバーフローの脆弱性が存在します。
Possible impacts	第三者により、IdToName RPC からの過度に大きなリストを介して、ヒープベースのバッファオーバーフローを誘発されることで、サービス運用妨害 (クラッシュ) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Feb. 21, 2013, midnight
Registration Date	March 19, 2013, 8:06 p.m.
Last Update	March 19, 2013, 8:06 p.m.

CVSS2.0 : 警告
Score	5
Vector	AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected System

OpenAFS

OpenAFS 1.6.2 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2013-1795	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1795
National Vulnerability Database (NVD)
2	CVE-2013-1795	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-1795

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-189	https://jvndb.jvn.jp/ja/cwe/CWE-189.html

ベンダー情報

No	Name	URL
Debian セキュリティ勧告
1	DSA-2638	http://www.debian.org/security/2013/dsa-2638
OpenAFS Security Advisory
2	OPENAFS-SA-2013-002	http://www.openafs.org/pages/security/OPENAFS-SA-2013-002.txt

Change Log

No	Changed Details	Date of change
0	[2013年03月19日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2013-1795

Summary	Integer overflow in ptserver in OpenAFS before 1.6.2 allows remote attackers to cause a denial of service (crash) via a large list from the IdToName RPC, which triggers a heap-based buffer overflow.
Publication Date	March 14, 2013, 12:13 p.m.
Registration Date	Jan. 26, 2021, 3:37 p.m.
Last Update	Nov. 21, 2024, 10:50 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:openafs:openafs:1.5.73:::::::*
cpe:2.3:a:openafs:openafs:1.5.25:::::::*
cpe:2.3:a:openafs:openafs:1.5.27:::::::*
cpe:2.3:a:openafs:openafs:1.5.35:::::::*
cpe:2.3:a:openafs:openafs:1.5.74:::::::*
cpe:2.3:a:openafs:openafs:1.5.29:::::::*
cpe:2.3:a:openafs:openafs:1.5.23:::::::*
cpe:2.3:a:openafs:openafs:1.5.68:::::::*
cpe:2.3:a:openafs:openafs:1.6.0:::::::*
cpe:2.3:a:openafs:openafs:1.5.32:::::::*
cpe:2.3:a:openafs:openafs:1.5.33:::::::*
cpe:2.3:a:openafs:openafs:1.5.62:::::::*
cpe:2.3:a:openafs:openafs:1.5.50:::::::*
cpe:2.3:a:openafs:openafs:1.5.72:::::::*
cpe:2.3:a:openafs:openafs:1.5.13:::::::*
cpe:2.3:a:openafs:openafs:1.5.71:::::::*
cpe:2.3:a:openafs:openafs:1.5.12:::::::*
cpe:2.3:a:openafs:openafs:1.5.56:::::::*
cpe:2.3:a:openafs:openafs:1.5.30:::::::*
cpe:2.3:a:openafs:openafs:1.5.39:::::::*
cpe:2.3:a:openafs:openafs:1.5.26:::::::*
cpe:2.3:a:openafs:openafs:1.5.15:::::::*
cpe:2.3:a:openafs:openafs:1.5.31:::::::*
cpe:2.3:a:openafs:openafs:1.5.16:::::::*
cpe:2.3:a:openafs:openafs:1.5.24:::::::*
cpe:2.3:a:openafs:openafs:1.5.59:::::::*
cpe:2.3:a:openafs:openafs:1.5.53:::::::*
cpe:2.3:a:openafs:openafs:1.5.61:::::::*
cpe:2.3:a:openafs:openafs:1.5.14:::::::*
cpe:2.3:a:openafs:openafs:1.5.18:::::::*
cpe:2.3:a:openafs:openafs:1.5.77:::::::*
cpe:2.3:a:openafs:openafs:1.5.36:::::::*
cpe:2.3:a:openafs:openafs:1.5.67:::::::*
cpe:2.3:a:openafs:openafs:1.5.20:::::::*
cpe:2.3:a:openafs:openafs:1.5.19:::::::*
cpe:2.3:a:openafs:openafs:1.5.58:::::::*
cpe:2.3:a:openafs:openafs:1.5.10:::::::*
cpe:2.3:a:openafs:openafs:1.5.63:::::::*
cpe:2.3:a:openafs:openafs::::::::		1.6.1
cpe:2.3:a:openafs:openafs:1.5.38:::::::*
cpe:2.3:a:openafs:openafs:1.5.37:::::::*
cpe:2.3:a:openafs:openafs:1.5.17:::::::*
cpe:2.3:a:openafs:openafs:1.5.64:::::::*
cpe:2.3:a:openafs:openafs:1.5.21:::::::*
cpe:2.3:a:openafs:openafs:1.5.52:::::::*
cpe:2.3:a:openafs:openafs:1.5.60:::::::*
cpe:2.3:a:openafs:openafs:1.5.55:::::::*
cpe:2.3:a:openafs:openafs:1.5.69:::::::*
cpe:2.3:a:openafs:openafs:1.5.70:::::::*
cpe:2.3:a:openafs:openafs:1.5.51:::::::*
cpe:2.3:a:openafs:openafs:1.5.75:::::::*
cpe:2.3:a:openafs:openafs:1.5.34:::::::*
cpe:2.3:a:openafs:openafs:1.5.22:::::::*
cpe:2.3:a:openafs:openafs:1.5.78:::::::*
cpe:2.3:a:openafs:openafs:1.5.11:::::::*
cpe:2.3:a:openafs:openafs:1.5.57:::::::*
cpe:2.3:a:openafs:openafs:1.5.76:::::::*
cpe:2.3:a:openafs:openafs:1.5.65:::::::*
cpe:2.3:a:openafs:openafs:1.5.66:::::::*
cpe:2.3:a:openafs:openafs:1.5.54:::::::*
cpe:2.3:a:openafs:openafs:1.5.28:::::::*

Related information, measures and tools

No	URL	タグ
1	http://secunia.com/advisories/52342	Permissions Required Third Party Advisory
2	http://secunia.com/advisories/52342	Permissions Required Third Party Advisory
3	http://secunia.com/advisories/52480	Permissions Required Third Party Advisory
4	http://secunia.com/advisories/52480	Permissions Required Third Party Advisory
5	http://www.debian.org/security/2013/dsa-2638
6	http://www.debian.org/security/2013/dsa-2638
7	http://www.mandriva.com/security/advisories?name=MDVSA-2014:244	Broken Link
8	http://www.mandriva.com/security/advisories?name=MDVSA-2014:244	Broken Link
9	http://www.openafs.org/pages/security/OPENAFS-SA-2013-002.txt	Vendor Advisory
10	http://www.openafs.org/pages/security/OPENAFS-SA-2013-002.txt	Vendor Advisory
11	http://www.securityfocus.com/bid/58300	Third Party Advisory VDB Entry
12	http://www.securityfocus.com/bid/58300	Third Party Advisory VDB Entry
13	https://exchange.xforce.ibmcloud.com/vulnerabilities/82585
14	https://exchange.xforce.ibmcloud.com/vulnerabilities/82585

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-189	数値処理の問題	https://cwe.mitre.org/data/definitions/189.html

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:openafs:openafs:1.5.73:::::::*
cpe:2.3:a:openafs:openafs:1.5.25:::::::*
cpe:2.3:a:openafs:openafs:1.5.27:::::::*
cpe:2.3:a:openafs:openafs:1.5.35:::::::*
cpe:2.3:a:openafs:openafs:1.5.74:::::::*
cpe:2.3:a:openafs:openafs:1.5.29:::::::*
cpe:2.3:a:openafs:openafs:1.5.23:::::::*
cpe:2.3:a:openafs:openafs:1.5.68:::::::*
cpe:2.3:a:openafs:openafs:1.6.0:::::::*
cpe:2.3:a:openafs:openafs:1.5.32:::::::*
cpe:2.3:a:openafs:openafs:1.5.33:::::::*
cpe:2.3:a:openafs:openafs:1.5.62:::::::*
cpe:2.3:a:openafs:openafs:1.5.50:::::::*
cpe:2.3:a:openafs:openafs:1.5.72:::::::*
cpe:2.3:a:openafs:openafs:1.5.13:::::::*
cpe:2.3:a:openafs:openafs:1.5.71:::::::*
cpe:2.3:a:openafs:openafs:1.5.12:::::::*
cpe:2.3:a:openafs:openafs:1.5.56:::::::*
cpe:2.3:a:openafs:openafs:1.5.30:::::::*
cpe:2.3:a:openafs:openafs:1.5.39:::::::*
cpe:2.3:a:openafs:openafs:1.5.26:::::::*
cpe:2.3:a:openafs:openafs:1.5.15:::::::*
cpe:2.3:a:openafs:openafs:1.5.31:::::::*
cpe:2.3:a:openafs:openafs:1.5.16:::::::*
cpe:2.3:a:openafs:openafs:1.5.24:::::::*
cpe:2.3:a:openafs:openafs:1.5.59:::::::*
cpe:2.3:a:openafs:openafs:1.5.53:::::::*
cpe:2.3:a:openafs:openafs:1.5.61:::::::*
cpe:2.3:a:openafs:openafs:1.5.14:::::::*
cpe:2.3:a:openafs:openafs:1.5.18:::::::*
cpe:2.3:a:openafs:openafs:1.5.77:::::::*
cpe:2.3:a:openafs:openafs:1.5.36:::::::*
cpe:2.3:a:openafs:openafs:1.5.67:::::::*
cpe:2.3:a:openafs:openafs:1.5.20:::::::*
cpe:2.3:a:openafs:openafs:1.5.19:::::::*
cpe:2.3:a:openafs:openafs:1.5.58:::::::*
cpe:2.3:a:openafs:openafs:1.5.10:::::::*
cpe:2.3:a:openafs:openafs:1.5.63:::::::*
cpe:2.3:a:openafs:openafs::::::::		1.6.1
cpe:2.3:a:openafs:openafs:1.5.38:::::::*
cpe:2.3:a:openafs:openafs:1.5.37:::::::*
cpe:2.3:a:openafs:openafs:1.5.17:::::::*
cpe:2.3:a:openafs:openafs:1.5.64:::::::*
cpe:2.3:a:openafs:openafs:1.5.21:::::::*
cpe:2.3:a:openafs:openafs:1.5.52:::::::*
cpe:2.3:a:openafs:openafs:1.5.60:::::::*
cpe:2.3:a:openafs:openafs:1.5.55:::::::*
cpe:2.3:a:openafs:openafs:1.5.69:::::::*
cpe:2.3:a:openafs:openafs:1.5.70:::::::*
cpe:2.3:a:openafs:openafs:1.5.51:::::::*
cpe:2.3:a:openafs:openafs:1.5.75:::::::*
cpe:2.3:a:openafs:openafs:1.5.34:::::::*
cpe:2.3:a:openafs:openafs:1.5.22:::::::*
cpe:2.3:a:openafs:openafs:1.5.78:::::::*
cpe:2.3:a:openafs:openafs:1.5.11:::::::*
cpe:2.3:a:openafs:openafs:1.5.57:::::::*
cpe:2.3:a:openafs:openafs:1.5.76:::::::*
cpe:2.3:a:openafs:openafs:1.5.65:::::::*
cpe:2.3:a:openafs:openafs:1.5.66:::::::*
cpe:2.3:a:openafs:openafs:1.5.54:::::::*
cpe:2.3:a:openafs:openafs:1.5.28:::::::*