Security bugs are reported here via bugzilla

[Seth Alan Woolley <seth AT positivism.org>]

For all you running samba on the open Internet ;)

There's a workaround of setting 'wide links = no' in smb.conf until the 
spell is patched.

Seth

----- Forwarded message from "Gerald (Jerry) Carter" <jerry AT samba.org> -----

Precedence: bulk
Date: Thu, 30 Sep 2004 05:17:35 -0500
From: "Gerald (Jerry) Carter" <jerry AT samba.org>
To: bugtraq AT securityfocus.com
Cc: security AT samba.org
Subject: Samba Security Announcement -- Potential Arbitrary File Access
X-Spambayes-Classification: spam; 0.04

Subject:        Potential Arbitrary File Access

Affected
Versions:       Samba 2.2.x <= 2.2.11 and Samba 3.0.x <= 3.0.5

Summary:        A remote attacker may be able to gain access
                to files which exist outside of the share's
                defined path. Such files must still be readable
                by the account used for the connection.


Patch Availability
------------------
The patch for Samba 3.0.5 and earlier releases
(samba-3.0.5-reduce_name.patch) can be downloaded
from http://download.samba.org/samba/ftp/patches/security/

Samba 2.2.12 has been released to specifically address
this bug.


Description
-----------

A bug in the input validation routines used to convert DOS
path names to path names on the Samba host's file system
may be exploited to gain access to files outside of the
share's path defined by smb.conf.


Protecting Unpatched Servers
----------------------------

Samba file shares with 'wide links = no' (a non-default setting)
in the service definition in smb.conf are *not* vulnerable to
this attack.

The Samba Team always encourages users to run the latest stable
release as a defense of against attacks.  However, under certain
circumstances it may not be possible to immediately upgrade
important installations.  In such cases, administrators should
read the "Server Security" documentation found at
http://www.samba.org/samba/docs/server_security.html.


Credits
--------

Both security issues were reported to Samba developers by
iDEFENSE (http://www.idefense.com/).  Karol Wiesek is credited
with this discovery.



--
Our Code, Our Bugs, Our Responsibility.

                                -- The Samba Team


----- End forwarded message -----

-- 
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Key id EF10E21A = 36AD 8A92 8499 8439 E6A8  3724 D437 AF5D EF10 E21A
http://smgl.positivism.org:11371/pks/lookup?op=get&search=0xEF10E21A
Security Team Leader Source Mage GNU/Linux http://www.sourcemage.org

Attachment: pgp4aYlfge2S0.pgp
Description: PGP signature