CVE-2013-4134: Weak Encryption
Published Nov 5, 2013
·Updated
OpenAFS before 1.4.15, 1.6.x before 1.6.5, and 1.7.x before 1.7.26 uses weak encryption (DES) for Kerberos keys, which makes it easier for remote attackers to obtain the service key.
Affected Software
81 affected components
OpenAFS OpenAFS<=1.4.14
OpenAFS OpenAFS=1.0
OpenAFS OpenAFS=1.0.1
OpenAFS OpenAFS=1.0.2
OpenAFS OpenAFS=1.0.3
OpenAFS OpenAFS=1.0.4
OpenAFS OpenAFS=1.0.4a
OpenAFS OpenAFS=1.1
OpenAFS OpenAFS=1.1.0
OpenAFS OpenAFS=1.1.1
OpenAFS OpenAFS=1.1.1a
OpenAFS OpenAFS=1.2
OpenAFS OpenAFS=1.2.1
OpenAFS OpenAFS=1.2.2
OpenAFS OpenAFS=1.2.2a
OpenAFS OpenAFS=1.2.2b
OpenAFS OpenAFS=1.2.3
OpenAFS OpenAFS=1.2.4
OpenAFS OpenAFS=1.2.5
OpenAFS OpenAFS=1.2.6
OpenAFS OpenAFS=1.2.7
OpenAFS OpenAFS=1.2.8
OpenAFS OpenAFS=1.2.9
OpenAFS OpenAFS=1.2.10
OpenAFS OpenAFS=1.2.11
OpenAFS OpenAFS=1.2.13
OpenAFS OpenAFS=1.3
OpenAFS OpenAFS=1.3.1
OpenAFS OpenAFS=1.3.2
OpenAFS OpenAFS=1.3.5
OpenAFS OpenAFS=1.3.70
OpenAFS OpenAFS=1.3.74
OpenAFS OpenAFS=1.3.77
OpenAFS OpenAFS=1.3.81
OpenAFS OpenAFS=1.4
OpenAFS OpenAFS=1.4.0
OpenAFS OpenAFS=1.4.1
OpenAFS OpenAFS=1.4.2
OpenAFS OpenAFS=1.4.3
OpenAFS OpenAFS=1.4.4
OpenAFS OpenAFS=1.4.5
OpenAFS OpenAFS=1.4.6
OpenAFS OpenAFS=1.4.7
OpenAFS OpenAFS=1.4.7_pre1
OpenAFS OpenAFS=1.4.7_pre2
OpenAFS OpenAFS=1.4.7_pre3
OpenAFS OpenAFS=1.4.7_pre4
OpenAFS OpenAFS=1.4.7_pre5
OpenAFS OpenAFS=1.4.8
OpenAFS OpenAFS=1.4.8_pre1
OpenAFS OpenAFS=1.4.8_pre2
OpenAFS OpenAFS=1.4.8_pre3
OpenAFS OpenAFS=1.4.12
OpenAFS OpenAFS=1.6.0
OpenAFS OpenAFS=1.6.1
OpenAFS OpenAFS=1.6.2
OpenAFS OpenAFS=1.6.2.1
OpenAFS OpenAFS=1.6.3
OpenAFS OpenAFS=1.6.4
OpenAFS OpenAFS=1.7.1
OpenAFS OpenAFS=1.7.2
OpenAFS OpenAFS=1.7.3
OpenAFS OpenAFS=1.7.4
OpenAFS OpenAFS=1.7.8
OpenAFS OpenAFS=1.7.10
OpenAFS OpenAFS=1.7.11
OpenAFS OpenAFS=1.7.12
OpenAFS OpenAFS=1.7.13
OpenAFS OpenAFS=1.7.14
OpenAFS OpenAFS=1.7.15
OpenAFS OpenAFS=1.7.16
OpenAFS OpenAFS=1.7.17
OpenAFS OpenAFS=1.7.18
OpenAFS OpenAFS=1.7.19
OpenAFS OpenAFS=1.7.20
OpenAFS OpenAFS=1.7.21
OpenAFS OpenAFS=1.7.22
OpenAFS OpenAFS=1.7.23
OpenAFS OpenAFS=1.7.24
OpenAFS OpenAFS=1.7.25
Debian Debian Linux=7.0
Event History
Nov 5, 2013
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2013-4134?
CVE-2013-4134 has a medium severity rating due to its use of weak encryption for Kerberos keys.
2
How do I fix CVE-2013-4134?
To fix CVE-2013-4134, upgrade OpenAFS to versions 1.4.15, 1.6.5, or 1.7.26 and later.
3
What systems are affected by CVE-2013-4134?
CVE-2013-4134 affects OpenAFS versions prior to 1.4.15, 1.6.x before 1.6.5, and 1.7.x before 1.7.26.
4
What exploit capabilities does CVE-2013-4134 provide to attackers?
CVE-2013-4134 allows remote attackers to potentially obtain the service key due to weak encryption.
5
Is there a workaround for CVE-2013-4134?
There are no effective workarounds for CVE-2013-4134; upgrading to a secure version is recommended.