[Full-Disclosure] MDKSA-2004:104 - Updated samba packages fix vulnerability

From: Mandrake Linux Security Team (security_at_linux-mandrake.com)
Date: 10/02/04

Next message: Thierry Carrez: "[ GLSA 200410-01 ] sharutils: Buffer overflows in shar.c and unshar.c"

Previous message: Luigi Auriemma: "Broadcast buffer-overflow in Vypress Messenger 3.5.1"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

To: full-disclosure@lists.netsys.com
Date: 1 Oct 2004 22:06:56 -0000

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandrakelinux Security Update Advisory
_______________________________________________________________________

Package name: samba
Advisory ID: MDKSA-2004:104
Date: October 1st, 2004

Affected versions: 9.2, Corporate Server 2.1
______________________________________________________________________

Problem Description:

Karol Wiesek discovered a bug in the input validation routines used to
convert DOS path names to path names on the Samba host's file system.
This bug can be exploited to gain access to files outside of the
share's path as defined in the smb.conf configuration file. This
vulnerability exists in all samba 2.2.x versions up to and including
2.2.11 and also in samba 3.0.x up to and including 3.0.5.

The updated packages have been patched to correct this issue.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0815
______________________________________________________________________

Updated Packages:

Corporate Server 2.1:
c2e81998de4c1613beebd82caab08c85 corporate/2.1/RPMS/nss_wins-2.2.7a-10.3.C21mdk.i586.rpm
5ba314544f64d34f8fb655290be13e5f corporate/2.1/RPMS/samba-client-2.2.7a-10.3.C21mdk.i586.rpm
40d9640f87efefaf8055f07c420d775a corporate/2.1/RPMS/samba-common-2.2.7a-10.3.C21mdk.i586.rpm
52b9a76e0c46403a8d6f9ee950755e17 corporate/2.1/RPMS/samba-doc-2.2.7a-10.3.C21mdk.i586.rpm
cc75f89aa1838b49706480194d97557d corporate/2.1/RPMS/samba-server-2.2.7a-10.3.C21mdk.i586.rpm
a323403badf1ef89fdc096ecee185adf corporate/2.1/RPMS/samba-swat-2.2.7a-10.3.C21mdk.i586.rpm
9ac199d2afe27f90a3b8e2c8db579eaf corporate/2.1/RPMS/samba-winbind-2.2.7a-10.3.C21mdk.i586.rpm
274439208095c79431d625fd4770b873 corporate/2.1/SRPMS/samba-2.2.7a-10.3.C21mdk.src.rpm

Corporate Server 2.1/x86_64:
298a9ab15d25ab143071669eb57b8e8e x86_64/corporate/2.1/RPMS/nss_wins-2.2.7a-10.3.C21mdk.x86_64.rpm
1a912c22194d4a27915e3ef17bca782f x86_64/corporate/2.1/RPMS/samba-client-2.2.7a-10.3.C21mdk.x86_64.rpm
e4c30b68704c4267b9d96edb2c62fbd9 x86_64/corporate/2.1/RPMS/samba-common-2.2.7a-10.3.C21mdk.x86_64.rpm
5324b0ea0fead78d072053ebea1953ef x86_64/corporate/2.1/RPMS/samba-doc-2.2.7a-10.3.C21mdk.x86_64.rpm
4352e555abbadee56277caa5b13ccaf3 x86_64/corporate/2.1/RPMS/samba-server-2.2.7a-10.3.C21mdk.x86_64.rpm
10ff20c71b1f0a6f02678b498a12e2ab x86_64/corporate/2.1/RPMS/samba-swat-2.2.7a-10.3.C21mdk.x86_64.rpm
7c8bb6655fa760bf938aa257aec0e95d x86_64/corporate/2.1/RPMS/samba-winbind-2.2.7a-10.3.C21mdk.x86_64.rpm
274439208095c79431d625fd4770b873 x86_64/corporate/2.1/SRPMS/samba-2.2.7a-10.3.C21mdk.src.rpm

Mandrakelinux 9.2:
0d048a0c1b432ed76517abc3220cd454 9.2/RPMS/libsmbclient0-2.2.8a-13.3.92mdk.i586.rpm
4c7bbb265365e047784f09dcfff3fe7f 9.2/RPMS/libsmbclient0-devel-2.2.8a-13.3.92mdk.i586.rpm
21d90aa58c19709a8978bb8084647121 9.2/RPMS/libsmbclient0-static-devel-2.2.8a-13.3.92mdk.i586.rpm
ea75da243b2f6a380cfdc774b9dff534 9.2/RPMS/nss_wins-2.2.8a-13.3.92mdk.i586.rpm
d70ff8e722fabd62d94b139eab65f8c9 9.2/RPMS/samba-client-2.2.8a-13.3.92mdk.i586.rpm
47684bc4eda4b716da37c70592103817 9.2/RPMS/samba-common-2.2.8a-13.3.92mdk.i586.rpm
11a74418ef5a1a037aadac3c635427e9 9.2/RPMS/samba-debug-2.2.8a-13.3.92mdk.i586.rpm
5025e9c06a973b0387d5a841e2ab1329 9.2/RPMS/samba-doc-2.2.8a-13.3.92mdk.i586.rpm
55759de483bcb5ee3267c5ee58e57ee5 9.2/RPMS/samba-server-2.2.8a-13.3.92mdk.i586.rpm
ef2ad8330303b36681dddc8b1084e086 9.2/RPMS/samba-swat-2.2.8a-13.3.92mdk.i586.rpm
4f5b7e9b6d2c6d9a4e36082010dd4842 9.2/RPMS/samba-winbind-2.2.8a-13.3.92mdk.i586.rpm
ac2a2c9b8cc3a00492ad9130ac44acfe 9.2/SRPMS/samba-2.2.8a-13.3.92mdk.src.rpm

Mandrakelinux 9.2/AMD64:
dc262d5a29a0fa0f38f34bc94457b357 amd64/9.2/RPMS/lib64smbclient0-2.2.8a-13.3.92mdk.amd64.rpm
7191f5b24de86da9c7c3764c6c4bdef7 amd64/9.2/RPMS/lib64smbclient0-devel-2.2.8a-13.3.92mdk.amd64.rpm
b899415999930067fc0b68f20c1a0240 amd64/9.2/RPMS/lib64smbclient0-static-devel-2.2.8a-13.3.92mdk.amd64.rpm
3d5d7678586aef4c593c906cd5282f30 amd64/9.2/RPMS/nss_wins-2.2.8a-13.3.92mdk.amd64.rpm
683e530b367a618e72c10f13c152d2f6 amd64/9.2/RPMS/samba-client-2.2.8a-13.3.92mdk.amd64.rpm
56f438efb2b5dd45fab3e0cb051cb138 amd64/9.2/RPMS/samba-common-2.2.8a-13.3.92mdk.amd64.rpm
d5c702e2157b9f2e2f9a0d7bde2d04b6 amd64/9.2/RPMS/samba-debug-2.2.8a-13.3.92mdk.amd64.rpm
c0e2a1badc6458424d707736e747f3db amd64/9.2/RPMS/samba-doc-2.2.8a-13.3.92mdk.amd64.rpm
28162d96ccf468125956af8f0aa00f63 amd64/9.2/RPMS/samba-server-2.2.8a-13.3.92mdk.amd64.rpm
6b0e6353ebd8e72b574de382e1c22a65 amd64/9.2/RPMS/samba-swat-2.2.8a-13.3.92mdk.amd64.rpm
dea3db5f940ebf772a76fed0600c92a4 amd64/9.2/RPMS/samba-winbind-2.2.8a-13.3.92mdk.amd64.rpm
ac2a2c9b8cc3a00492ad9130ac44acfe amd64/9.2/SRPMS/samba-2.2.8a-13.3.92mdk.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrakeUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandrakesoft for security. You can obtain
the GPG public key of the Mandrakelinux Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandrakelinux at:

http://www.mandrakesoft.com/security/advisories

If you want to report vulnerabilities, please contact

security_linux-mandrake.com

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Linux Mandrake Security Team
<security linux-mandrake.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQFBXdUAmqjQ0CJFipgRAvazAJ9Gvgw1c4H0E0/sKzJqgVQs5Y5uhACgmceV
Yczn5J/2dTCMzS20uu3LzBY=
=loIX
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

Next message: Thierry Carrez: "[ GLSA 200410-01 ] sharutils: Buffer overflows in shar.c and unshar.c"

Previous message: Luigi Auriemma: "Broadcast buffer-overflow in Vypress Messenger 3.5.1"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Relevant Pages

[Full-Disclosure] MDKSA-2004:131 - Updated samba packages fix DoS vulnerability
... Samba 3.x used to match filename strings containing wildcard ... This bug may allow a user to consume more than normal ... The updated packages are patched to prevent this problem with patches ... the GPG public key of the Mandrakelinux Security Team by executing: ...
(Full-Disclosure)
MDKSA-2004:104 - Updated samba packages fix vulnerability
... Karol Wiesek discovered a bug in the input validation routines used to ... convert DOS path names to path names on the Samba host's file system. ... The updated packages have been patched to correct this issue. ... the GPG public key of the Mandrakelinux Security Team by executing: ...
(Bugtraq)
[cifs] Share root directory appears in subdirectories. (Well, cant actually see it but can cd into i
... I'm having some problem with cifs mounts here, it seems so be a bug. ... I've posted this on the samba mailing list, but it seems to me like the samba mailing list ... I played around a bit and found the following out: The problem appears when a directory has the same name as the mount point. ... I had some private EMail exchange with Mark Adams and it seems like I really hit a bug in cifs. ...
(Linux-Kernel)
[SAMBA-SECURITY] CVE-2007-0452: Potential DoS against smbd in Samba 3.0.6 - 3.0.23d
... Internally Samba's file server daemon, smbd, implements ... This bug may allow an authenticated user to exhaust resources ... A patch against Samba 3.0.23d has been attached to this ... pstrcpy(file, s); ...
(Bugtraq)
[Full-Disclosure] ERRATA: [ GLSA 200409-14 ] Samba: Remote printing non-vulnerability
... This advisory incorrectly described Samba versions as being vulnerable ... Samba has a bug with out of sequence print change notification ... handled print change notification requests in an invalid order. ... this bug has no security impact ...
(Full-Disclosure)