Nom du paquet
samba
Date
2001-06-29
Advisory ID
MDKSA-2001:062
Affected versions
8.0 i586 , 7.2 i586 , 7.1 i586 , CS1.0 i586

Problem description

Michal Zalewski has found a vulnerability in all versions of Samba prior to 2.0.10 where if a client sends an invalid netbios name Samba could be tricked into appending it's log to files writable by root. This can be very dangerous if combined with a symlink created by a local user. Note that the log files must be specified as %m.log in order for this to work, and Mandrake Linux ships Samba by default using log.%m, thus it is not vulnerable "out of the box".

Updated packages

8.0 i586

 74c9279dfa603c53bb6d3849a6d8cb02  8.0/RPMS/samba-2.0.10-1.1mdk.i586.rpm
c2c233ff7fc7154605fde704667beee6  8.0/RPMS/samba-client-2.0.10-1.1mdk.i586.rpm
baaa778fe9e7c7bea536ebf827c02297  8.0/RPMS/samba-common-2.0.10-1.1mdk.i586.rpm
449f10822df5ccc49f839159e71a2019  8.0/SRPMS/samba-2.0.10-1.1mdk.src.rpm

7.2 i586

 991fdcad4c631cfa060bbc21374d2dd8  7.2/RPMS/samba-2.0.10-1.2mdk.i586.rpm
1da8547bb88864fd974f85efcd2643de  7.2/RPMS/samba-client-2.0.10-1.2mdk.i586.rpm
56420cded466e9a86b3159d2071fcb10  7.2/RPMS/samba-common-2.0.10-1.2mdk.i586.rpm
a5069f151064c25b4eafafb5e664c6e7  7.2/SRPMS/samba-2.0.10-1.2mdk.src.rpm

7.1 i586

 56c2fd045833640c08f5380576f16410  7.1/RPMS/samba-2.0.10-1.3mdk.i586.rpm
c377973bfd8b699678e64d9a9b1674a3  7.1/RPMS/samba-client-2.0.10-1.3mdk.i586.rpm
030523ef3ac70fced03849c478c1ebfe  7.1/RPMS/samba-common-2.0.10-1.3mdk.i586.rpm
6a1e2d71492868704051133c7cea7f60  7.1/SRPMS/samba-2.0.10-1.3mdk.src.rpm

CS1.0 i586

 5143308e3d3fea7e4d2905476819019c  1.0.1/RPMS/samba-2.0.10-1.3mdk.i586.rpm
0bf16d228879342e07bd721d3acd32a3  1.0.1/RPMS/samba-client-2.0.10-1.3mdk.i586.rpm
f5a02b96c6865561d4685ab12ea1bbb2  1.0.1/RPMS/samba-common-2.0.10-1.3mdk.i586.rpm
6a1e2d71492868704051133c7cea7f60  1.0.1/SRPMS/samba-2.0.10-1.3mdk.src.rpm

References