Security World: [SECURITY] [DSA-2109-1] New samba packages fix buffer overflow

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-2109-1 security@debian.org
http://www.debian.org/security/ Stefan Fritsch
September 16, 2010 http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package : samba
Vulnerability : buffer overflow
Problem type : remote
Debian-specific: no
CVE Id(s) : CVE-2010-3069
Debian bug : 596891

A vulnerability has been discovered in samba, a SMB/CIFS file, print,
and login server for Unix.

The sid_parse() function does not correctly check its input lengths
when reading a binary representation of a Windows SID (Security ID).
This allows a malicious client to send a sid that can overflow the
stack variable that is being used to store the SID in the Samba smbd
server. (CVE-2010-3069)

For the stable distribution (lenny), this problem has been fixed in
version 3.2.5-4lenny13.

For the testing distribution (squeeze) and the unstable distribution (sid),
this problem will be fixed in version 3.5.5~dfsg-1.

We recommend that you upgrade your samba packages. The packages for the
mips architecture are not included in this upgrade. They will be released
as soon as they become available.

Upgrade instructions
- --------------------

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 5.0 alias lenny (stable)
- -----------------------------------------

Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny13.dsc
Size/MD5 checksum: 1834 eca5531616077567a13aa70c77c24930
http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5.orig.tar.gz
Size/MD5 checksum: 50276407 0f7539e09803ae60a2912e70adf1c747
http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny13.diff.gz
Size/MD5 checksum: 238904 69d9df4c5fd03523273a58464326d0fb

Architecture independent packages:

http://security.debian.org/pool/updates/main/s/samba/samba-doc-pdf_3.2.5-4lenny13_all.deb
Size/MD5 checksum: 6252920 302863fb9b5611992881228e1d3c0fec
http://security.debian.org/pool/updates/main/s/samba/samba-doc_3.2.5-4lenny13_all.deb
Size/MD5 checksum: 7949970 de6f2284630f59ca11c79a87d7f5cd37

alpha architecture (DEC Alpha)

amd64 architecture (AMD x86_64 (AMD64))

arm architecture (ARM)

armel architecture (ARM EABI)

hppa architecture (HP PA RISC)

i386 architecture (Intel ia32)

ia64 architecture (Intel ia64)

mipsel architecture (MIPS (Little Endian))

powerpc architecture (PowerPC)

s390 architecture (IBM S/390)

sparc architecture (Sun SPARC/UltraSPARC)

These files will probably be moved into the stable distribution on
its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iD4DBQFMkkusbxelr8HyTqQRAqhqAJiH79xS2Xu8cbUKBG1h/jMur9rUAJ96D4u7
JAZf4xxr9PQxvQPVzyslGQ==
=cVg1
-----END PGP SIGNATURE-----

--
To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: http://lists.debian.org/E1OwHke-0003mV-Vy@chopin.debian.org

Security World

Search This Blog

Thursday, September 16, 2010

[SECURITY] [DSA-2109-1] New samba packages fix buffer overflow

No comments: