Ispravljeni su višestruki sigurnosni propusti programskog paketa Samba. Udaljeni napadač može ih iskoristiti za pokretanje proizvoljnog programskog koda, izvođenje DoS napada, preuzimanje vlasništa nad dijeljenim datotekama te zaobilaženje postavljenih ograničenja nad datotekama. Lokalni napadač spomenute nedostatke može iskoristiti za izvođenje DoS napada i otkrivanje osjetljivih informacija.
Paket:
Samba 3.x
Operacijski sustavi:
Gentoo Linux
Kritičnost:
8.7
Problem:
pogreška u programskoj funkciji, pogreška u programskoj komponenti, preljev međuspremnika
Propusti su posljedica pogrešaka u funkcijama "chain_reply", "reply_sesssetup_and_X_spnego", "sid_parse", "dom_sid_parse" i "check_mtab", komponentama "smbd" i "smbfs" te generatoru RPC koda.
Posljedica:
Propuste je moguće iskoristiti za izvršavanje proizvoljnog programskog koda, DoS napad, preuzimanje vlasništa nad dijeljenim datotekama, zaobilaženje postavljenih ograničenja nad datotekama i čitanje povjerljivih podataka.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201206-22
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: High
Title: Samba: Multiple vulnerabilities
Date: June 24, 2012
Bugs: #290633, #310105, #323785, #332063, #337295, #356917,
#382263, #386375, #405551, #411487, #414319
ID: 201206-22
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been found in Samba, the worst of which
may allow execution of arbitrary code with root privileges.
Background
==========
Samba is a suite of SMB and CIFS client/server programs.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-fs/samba < 3.5.15 >= 3.5.15
Description
===========
Multiple vulnerabilities have been discovered in Samba. Please review
the CVE identifiers referenced below for details.
Impact
======
A remote attacker could possibly execute arbitrary code with root
privileges, cause a Denial of Service condition, take ownership of
shared files, or bypass file permissions. Furthermore, a local attacker
may be able to cause a Denial of Service condition or obtain sensitive
information in a Samba credentials file.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All Samba users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-fs/samba-3.5.15"
References
==========
[ 1 ] CVE-2009-2906
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-2906
[ 2 ] CVE-2009-2948
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-2948
[ 3 ] CVE-2010-0728
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-0728
[ 4 ] CVE-2010-1635
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1635
[ 5 ] CVE-2010-1642
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1642
[ 6 ] CVE-2010-2063
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-2063
[ 7 ] CVE-2010-3069
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3069
[ 8 ] CVE-2011-0719
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0719
[ 9 ] CVE-2011-1678
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1678
[ 10 ] CVE-2011-2724
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2724
[ 11 ] CVE-2012-0870
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0870
[ 12 ] CVE-2012-1182
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1182
[ 13 ] CVE-2012-2111
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2111
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201206-22.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite. or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2012 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
Posljednje sigurnosne preporuke