Nom du paquet
samba
Date
2009-12-06
Advisory ID
MDVSA-2009:320
Affected versions
2008.0 i586 , 2008.0 x86_64

Problem description

Multiple vulnerabilities has been found and corrected in samba:

The acl_group_override function in smbd/posix_acls.c in smbd in Samba
3.0.x before 3.0.35, 3.1.x and 3.2.x before 3.2.13, and 3.3.x before
3.3.6, when dos filemode is enabled, allows remote attackers to modify
access control lists for files via vectors related to read access to
uninitialized memory (CVE-2009-1888).

The SMB (aka Samba) subsystem in Apple Mac OS X 10.5.8, when Windows
File Sharing is enabled, does not properly handle errors in resolving
pathnames, which allows remote authenticated users to bypass intended
sharing restrictions, and read, create, or modify files, in certain
circumstances involving user accounts that lack home directories
(CVE-2009-2813).

smbd in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8,
and 3.4 before 3.4.2 allows remote authenticated users to cause a
denial of service (infinite loop) via an unanticipated oplock break
notification reply packet (CVE-2009-2906).

mount.cifs in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before
3.3.8 and 3.4 before 3.4.2, when mount.cifs is installed suid root,
does not properly enforce permissions, which allows local users to
read part of the credentials file and obtain the password by specifying
the path to the credentials file and using the --verbose or -v option
(CVE-2009-2948).

The version of samba shipping with Mandriva Linux 2008.0 has been
updated to the latest version (3.0.37) that includes the fixes for
these issues.

Updated packages

2008.0 i586

 dd63a83b66113c6868679d69c6465bc3  2008.0/i586/libsmbclient0-3.0.37-0.1mdv2008.0.i586.rpm
 93bfb74360ddc2dd279d4e2101f84fbc  2008.0/i586/libsmbclient0-devel-3.0.37-0.1mdv2008.0.i586.rpm
 321d998b7db0645174182d55ef20fcf7  2008.0/i586/libsmbclient0-static-devel-3.0.37-0.1mdv2008.0.i586.rpm
 be767601a25c3d2f7e3774a5389d4592  2008.0/i586/mount-cifs-3.0.37-0.1mdv2008.0.i586.rpm
 b907c06e94f80e049dcd70004f594c02  2008.0/i586/nss_wins-3.0.37-0.1mdv2008.0.i586.rpm
 917d9b433270264e4cf3b34f34d2321c  2008.0/i586/samba-client-3.0.37-0.1mdv2008.0.i586.rpm
 5708af3868e7285d8236438a86300f6b  2008.0/i586/samba-common-3.0.37-0.1mdv2008.0.i586.rpm
 ad4879729e556f3301081783bcaac490  2008.0/i586/samba-doc-3.0.37-0.1mdv2008.0.i586.rpm
 4e015a64b77bce05dfa3d867f050d012  2008.0/i586/samba-server-3.0.37-0.1mdv2008.0.i586.rpm
 d64cca7a719a74ec788a23fd312e3a99  2008.0/i586/samba-swat-3.0.37-0.1mdv2008.0.i586.rpm
 4e24335e02b04cc4c5bdd6ded27fdbe4  2008.0/i586/samba-vscan-icap-3.0.37-0.1mdv2008.0.i586.rpm
 c2db429ba1a00044a5e982737d1a182e  2008.0/i586/samba-winbind-3.0.37-0.1mdv2008.0.i586.rpm 
 3c440be2ff2004d3e3e79c30fd744991  2008.0/SRPMS/samba-3.0.37-0.1mdv2008.0.src.rpm

2008.0 x86_64

 11fd683e8881b23604d2087550abf530  2008.0/x86_64/lib64smbclient0-3.0.37-0.1mdv2008.0.x86_64.rpm
 64ecceaa599d680b8373efa8ad2a9d8d  2008.0/x86_64/lib64smbclient0-devel-3.0.37-0.1mdv2008.0.x86_64.rpm
 57d8e14a11103a828c3159173680ff9c  2008.0/x86_64/lib64smbclient0-static-devel-3.0.37-0.1mdv2008.0.x86_64.rpm
 0417912110787278d827193a39ba9e2e  2008.0/x86_64/mount-cifs-3.0.37-0.1mdv2008.0.x86_64.rpm
 142d13cb94cb2daba8d7db19b73bd5f8  2008.0/x86_64/nss_wins-3.0.37-0.1mdv2008.0.x86_64.rpm
 18e53c0c6376e59454d82e24df113e6b  2008.0/x86_64/samba-client-3.0.37-0.1mdv2008.0.x86_64.rpm
 4bc6e0d1b91696270ef591f700a96d10  2008.0/x86_64/samba-common-3.0.37-0.1mdv2008.0.x86_64.rpm
 7394ea34d00d1cc231d9755c553bb8c0  2008.0/x86_64/samba-doc-3.0.37-0.1mdv2008.0.x86_64.rpm
 d406df053249c2970cd180e4a1501d2d  2008.0/x86_64/samba-server-3.0.37-0.1mdv2008.0.x86_64.rpm
 34a7b8af585211e478e32182d7290f2b  2008.0/x86_64/samba-swat-3.0.37-0.1mdv2008.0.x86_64.rpm
 31fda5329b280c33c5ea5257af8ffb9e  2008.0/x86_64/samba-vscan-icap-3.0.37-0.1mdv2008.0.x86_64.rpm
 15e1b26b58908f28cf82d98f5f074304  2008.0/x86_64/samba-winbind-3.0.37-0.1mdv2008.0.x86_64.rpm 
 3c440be2ff2004d3e3e79c30fd744991  2008.0/SRPMS/samba-3.0.37-0.1mdv2008.0.src.rpm

References