CFS Multiple Buffer Overflow Vulnerabilities

Cryptographic File System (CFS) for Unix is a file system encryption package. Versions prior to 1.3.3-8.1 are vulnerable to a number of buffer overflow issues.

Whether or not these are exploitable to obtain privileges on the host is unknown at the present time. They can be used to initiate a denial of service condition against the encrypted file system, however.

Remote: Yes

Exploit: No exploit

Solution: Debian has provided fixed packages.

Matt Blaze cfs 1.3.3 Sparc:

Debian Upgrade cfs_1.3.3-8.1_sparc.deb 8.1_sparc.deb

Matt Blaze cfs 1.3.3 PPC:

Debian Upgrade cfs_1.3.3-8.1_powerpc.deb 8.1_powerpc.deb

Matt Blaze cfs 1.3.3 m68k:

Debian Upgrade cfs_1.3.3-8.1_m68k.deb 8.1_m68k.deb

Matt Blaze cfs 1.3.3 ia32:

Debian Upgrade cfs_1.3.3-8.1_i386.deb 8.1_i386.deb

Matt Blaze cfs 1.3.3 ARM:

Debian Upgrade cfs_1.3.3-8.1_arm.deb 8.1_arm.deb

Matt Blaze cfs 1.3.3 Alpha:

Debian Upgrade cfs_1.3.3-8.1_alpha.deb 8.1_alpha.deb

Matt Blaze cfs 1.3.3:

Debian Upgrade cfs_1.3.3.orig.tar.gz

Debian Patch cfs_1.3.3-8.1.diff.gz