MDKSA-2001:062
- Package name
- samba
- Date
- 2001-06-29
- Advisory ID
- MDKSA-2001:062
- Affected versions
- 8.0 i586 , 7.2 i586 , 7.1 i586 , CS1.0 i586
Problem description
Michal Zalewski has found a vulnerability in all versions of Samba prior to 2.0.10 where if a client sends an invalid netbios name Samba could be tricked into appending it's log to files writable by root. This can be very dangerous if combined with a symlink created by a local user. Note that the log files must be specified as %m.log in order for this to work, and Mandrake Linux ships Samba by default using log.%m, thus it is not vulnerable "out of the box".
Updated packages
8.0 i586
74c9279dfa603c53bb6d3849a6d8cb02 8.0/RPMS/samba-2.0.10-1.1mdk.i586.rpm c2c233ff7fc7154605fde704667beee6 8.0/RPMS/samba-client-2.0.10-1.1mdk.i586.rpm baaa778fe9e7c7bea536ebf827c02297 8.0/RPMS/samba-common-2.0.10-1.1mdk.i586.rpm 449f10822df5ccc49f839159e71a2019 8.0/SRPMS/samba-2.0.10-1.1mdk.src.rpm
7.2 i586
991fdcad4c631cfa060bbc21374d2dd8 7.2/RPMS/samba-2.0.10-1.2mdk.i586.rpm 1da8547bb88864fd974f85efcd2643de 7.2/RPMS/samba-client-2.0.10-1.2mdk.i586.rpm 56420cded466e9a86b3159d2071fcb10 7.2/RPMS/samba-common-2.0.10-1.2mdk.i586.rpm a5069f151064c25b4eafafb5e664c6e7 7.2/SRPMS/samba-2.0.10-1.2mdk.src.rpm
7.1 i586
56c2fd045833640c08f5380576f16410 7.1/RPMS/samba-2.0.10-1.3mdk.i586.rpm c377973bfd8b699678e64d9a9b1674a3 7.1/RPMS/samba-client-2.0.10-1.3mdk.i586.rpm 030523ef3ac70fced03849c478c1ebfe 7.1/RPMS/samba-common-2.0.10-1.3mdk.i586.rpm 6a1e2d71492868704051133c7cea7f60 7.1/SRPMS/samba-2.0.10-1.3mdk.src.rpm
CS1.0 i586
5143308e3d3fea7e4d2905476819019c 1.0.1/RPMS/samba-2.0.10-1.3mdk.i586.rpm 0bf16d228879342e07bd721d3acd32a3 1.0.1/RPMS/samba-client-2.0.10-1.3mdk.i586.rpm f5a02b96c6865561d4685ab12ea1bbb2 1.0.1/RPMS/samba-common-2.0.10-1.3mdk.i586.rpm 6a1e2d71492868704051133c7cea7f60 1.0.1/SRPMS/samba-2.0.10-1.3mdk.src.rpm