Skip to Content.
Sympa Menu

sm-grimoire-bugs - [SM-Grimoire-Bugs] [Bug 15437] New: Samba 3.4.1 Requires a security update.

sm-grimoire-bugs AT lists.ibiblio.org

Subject: SourceMage Grimoire Bug List

List archive

Chronological Thread  
  • From: bugzilla-daemon AT bugs.sourcemage.org
  • To: sm-grimoire-bugs AT lists.ibiblio.org
  • Subject: [SM-Grimoire-Bugs] [Bug 15437] New: Samba 3.4.1 Requires a security update.
  • Date: 3 Oct 2009 16:08:15 -0000

http://bugs.sourcemage.org/show_bug.cgi?id=15437

Summary: Samba 3.4.1 Requires a security update.
Product: Codex
Version: stable grimoire
Platform: x86
OS/Version: Linux
Status: NEW
Severity: normal
Priority: P3
Component: net
AssignedTo: sm-grimoire-bugs AT lists.ibiblio.org
ReportedBy: gsherwood AT sourcemage.org


According to http://www.samba.org/samba/history/samba-3.4.2.html

Three security issues are fixed in samba 3.4.2

This is a security release in order to address CVE-2009-2813, CVE-2009-2948
and CVE-2009-2906.

o CVE-2009-2813:
In all versions of Samba later than 3.0.11, connecting to the home
share of a user will use the root of the filesystem
as the home directory if this user is misconfigured to have
an empty home directory in /etc/passwd.

o CVE-2009-2948:
If mount.cifs is installed as a setuid program, a user can pass it a
credential or password path to which he or she does not have access and
then use the --verbose option to view the first line of that file.
All known Samba versions are affected.

o CVE-2009-2906:
Specially crafted SMB requests on authenticated SMB connections can
send smbd into a 100% CPU loop, causing a DoS on the Samba server.

--
Configure bugmail: http://bugs.sourcemage.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.




Archive powered by MHonArc 2.6.24.

Top of Page