Security World: [SECURITY] [DSA 1823-1] New samba packages fix several vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-1823-1 security@debian.org
http://www.debian.org/security/ Thijs Kinkhorst
June 25, 2009 http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package : samba
Vulnerability : several
Problem type : local (remote)
Debian-specific: no
CVE Id(s) : CVE-2009-1886 CVE-2009-1888

Several vulnerabilities have been discovered in Samba, a SMB/CIFS file,
print, and login server. The Common Vulnerabilities and Exposures project
identifies the following problems:

CVE-2009-1886

The smbclient utility contains a formatstring vulnerability where
commands dealing with file names treat user input as format strings
to asprintf.

CVE-2009-1888

In the smbd daemon, if a user is trying to modify an access control
list (ACL) and is denied permission, this deny may be overridden if
the parameter "dos filemode" is set to "yes" in the smb.conf and the
user already has write access to the file.

The old stable distribution (etch) is not affected by these problems.

For the stable distribution (lenny), these problems have been fixed in
version 3.2.5-4lenny6.

The unstable distribution (sid), which is only affected by CVE-2009-1888,
will be fixed soon.

We recommend that you upgrade your samba package.

Upgrade instructions
- --------------------

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 5.0 alias lenny
- --------------------------------

Source archives:

http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5.orig.tar.gz
Size/MD5 checksum: 50276407 0f7539e09803ae60a2912e70adf1c747
http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny6.dsc
Size/MD5 checksum: 2129 db28861cc892f2d668f1bfab3cb6c3c7
http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny6.diff.gz
Size/MD5 checksum: 230084 d852787acdea471c6360411043ca5e2d

Architecture independent packages:

http://security.debian.org/pool/updates/main/s/samba/samba-doc_3.2.5-4lenny6_all.deb
Size/MD5 checksum: 7952816 bd2754bfb3b0ddcedab4981f12e7dc48
http://security.debian.org/pool/updates/main/s/samba/samba-doc-pdf_3.2.5-4lenny6_all.deb
Size/MD5 checksum: 6252144 db04f0a55b0bbb6955a3ba832ca5857a

alpha architecture (DEC Alpha)

amd64 architecture (AMD x86_64 (AMD64))

arm architecture (ARM)

armel architecture (ARM EABI)

hppa architecture (HP PA RISC)

i386 architecture (Intel ia32)

ia64 architecture (Intel ia64)

mips architecture (MIPS (Big Endian))

mipsel architecture (MIPS (Little Endian))

powerpc architecture (PowerPC)

s390 architecture (IBM S/390)

sparc architecture (Sun SPARC/UltraSPARC)

These files will probably be moved into the stable distribution on
its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iQEcBAEBAgAGBQJKQ8ciAAoJECIIoQCMVaAcssgH/Rn/4KiHOVgAeLGLrbo3VCvT
jXCj4/OCGB/yUq7wHE7wurmBE6k+uGvi9rMPT9UpJbP9l8CYrZGtkTbW+7Jmb2Ri
xy2br9eaFUBGWXUyUFIN5LoRN47ODiCOh5AYbr4a+oNECSK1e7rNAkvFSOjIOwWp
nD3DautRDEFYs1EzRI/itNXBEG8oTMc6XLD6Iy151+5Zyv7Ayg0neERyUW06hWm/
YLKhdQGs9myoYOU3xVvVH0ZMqusDzphvJ/4rey+rVLIsmhh8Cge7ZIRdkoMHM4md
2Fx15JfuyRKdunzw/GKpv/5EzucdX+vtfTaTsdqqnOotUci5Yc7nA+CpIS2zGvA=
=EEGF
-----END PGP SIGNATURE-----

--
To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Security World

Search This Blog

Thursday, June 25, 2009

[SECURITY] [DSA 1823-1] New samba packages fix several vulnerabilities

No comments: