From 7b277de112bc880d1408a6a4a431d14612cc14f8 Mon Sep 17 00:00:00 2001 From: Stefan Fritsch Date: Thu, 31 May 2007 18:40:36 +0000 Subject: release samba DTSA git-svn-id: svn+ssh://svn.debian.org/svn/secure-testing@5952 e39458fd-73e7-0310-bf30-c45bca0a0e42 --- website/DTSA/DTSA-41-1.html | 105 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 105 insertions(+) create mode 100644 website/DTSA/DTSA-41-1.html (limited to 'website') diff --git a/website/DTSA/DTSA-41-1.html b/website/DTSA/DTSA-41-1.html new file mode 100644 index 0000000000..1759840e34 --- /dev/null +++ b/website/DTSA/DTSA-41-1.html @@ -0,0 +1,105 @@ + + + Debian testing security team - Advisory + + + + +
+ + + + + Debian Project +
+
+ + + + + + + + + + + +
+ Debian testing security team - Advisory +
+ + +
+ + +

DTSA-41-1

+
+
Date Reported:
+
May 31th, 2007
+
Affected Package:
+
samba
+
Vulnerability:
+
several vulnerabilities
+
Problem-Scope:
+
remote
+
Debian-specific:
+
No
+
CVE:
+
+CVE-2007-2444 +CVE-2007-2446 +CVE-2007-2447 +
+
More information:
+
Several issues have been identified in Samba, the SMB/CIFS file- and 
+print-server implementation for GNU/Linux. 
+ 
+CVE-2007-2444  
+ 
+When translating SIDs to/from names using Samba local list of user and group 
+accounts, a logic error in the smbd daemon's internal security stack may result 
+in a transition to the root user id rather than the non-root user. The user is 
+then able to temporarily issue SMB/CIFS protocol operations as the root user. 
+This window of opportunity may allow the attacker to establish addition means 
+of gaining root access to the server. 
+ 
+CVE-2007-2446  
+ 
+Various bugs in Samba's NDR parsing can allow a user to send specially crafted 
+MS-RPC requests that will overwrite the heap space with user defined data. 
+ 
+CVE-2007-2447  
+ 
+Unescaped user input parameters are passed as arguments to /bin/sh allowing for 
+remote command execution. 
+
+
For the testing distribution (lenny) this is fixed in version 3.0.24-6+lenny3
+
For the unstable distribution (sid) this is fixed in version 3.0.25-1
+
This upgrade is strongly recommended if you use samba.
+
If you have the secure testing lines in your sources.list, you can update by running this command as root:
+ +
apt-get update && apt-get upgrade
+
+ +
+
To use the Debian testing security archive, add the following lines to your /etc/apt/sources.list:
+
+
deb http://security.debian.org/ testing/updates main contrib non-free
+
deb-src http://security.debian.org/ testing/updates main contrib non-free
+
+ + +
+ + Valid HTML 4.01! + + Valid CSS! + + + + -- cgit v1.2.3