Vulnerability in Openafs
CVE-2013-4135
The vos command in OpenAFS 1.6.x before 1.6.5, when using the -encrypt option, only enables integrity protection and sends data in cleartext, which allows remote attackers to obtain sensitive information by sniffing the network.
Vulnerability class: POODLE (CVE-2014-3566)
EPSS: 0.019 (77.0th percentile) — read the EPSS interpretation.
Affected products
- Openafs — versions 1.6.0, 1.6.1, 1.6.2
- Debian Debian_linux — versions 7.0
- N/a — versions n/a
Weakness classification (CWE)
References
- secalert@redhat.com (x_refsource_CONFIRM, Vendor Advisory)
- secalert@redhat.com (vendor-advisory, Third Party Advisory, x_refsource_DEBIAN)
- secalert@redhat.com (vendor-advisory, x_refsource_MANDRIVA, Broken Link)