Security bugs are reported here via bugzilla

[Eric Sandall <eric AT sandall.us>]

Synopsis
========
A number of vulnerabilities were found in Samba 3.0.6 - 3.0.23d (inclusive)
[0]. Samba version 3.0.24 has been released to fix the vulnerabilities listed 
below and has been commited to test in commit id 
b4c9eda3ea75a2d4e70185005a61f65d39c3f6cb .

Background
==========
SMB server to provide Windows NT and LAN manager-style file and print
services to SMB clients such as Windows. A NetBIOS nameserver which
can provide browsing support. A ftp-like SMB client for accessing PC
resources from Unix.

Description
===========
  o CVE-2007-0452 (Potential Denial of Service bug in smbd)[1]
Internally Samba's file server daemon, smbd, implements
support for deferred file open calls in an attempt to serve
client requests that would otherwise fail due to a share mode
violation.  When renaming a file under certain circumstances
it is possible that the request is never removed from the deferred
open queue.  smbd will then become stuck is a loop trying to
service the open request.

This bug may allow an authenticated user to exhaust resources
such as memory and CPU on the server by opening multiple CIFS
sessions, each of which will normally spawn a new smbd process,
and sending each connection into an infinite loop.

  o CVE-2007-0454 (Format string bug in afsacl.so VFS plugin)[2]
NOTE: This security advisory only impacts Samba servers
that share AFS file systems to CIFS clients and which have
been explicitly instructed in smb.conf to load the afsacl.so
VFS module.

The source defect results in the name of a file stored on
disk being used as the format string in a call to snprintf().
This bug becomes exploitable only when a user is able
to write to a share which utilizes Samba's afsacl.so library
for setting Windows NT access control lists on files residing
on an AFS file system.

Affected packages
=================
samba in test, stable-rc, and stable grimoires.

Resolution
==========
All samba users should upgrade to the latest version:
# scribe update
# cast -c samba
OR
# scribe update
# sorcery queue-security
# cast --queue

stable-rc users will not be receiving the updated tarball until tomorrow 
(this 
is a testing branch, and not for common usage).

References
==========
[0] Samba security page http://samba.org/samba/history/security.html
[1] CVE-2007-0452 
http://lists.samba.org/archive/samba-announce/2007/000103.html
[2] CVE-2007-0454 
http://lists.samba.org/archive/samba-announce/2007/000105.html

-sandalle

PS: Sorry for the double-post, kmail apparently doesn't sign an e-mail when 
sending if it was opened as a draft. :/

-- 
Eric Sandall                       | Source Mage GNU/Linux Developer
eric at sandall.us PGP: 0xA8EFDD61 | http://www.sourcemage.org/
http://eric.sandall.us/            | http://counter.li.org/  #196285

Attachment: pgp52O7mYD5bq.pgp
Description: PGP signature