-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- CONECTIVA LINUX SECURITY ANNOUNCEMENT - -------------------------------------------------------------------------- PACKAGE : samba SUMMARY : Buffer overflow vulnerability DATE : 2002-11-22 16:13:00 ID : CLA-2002:550 RELEVANT RELEASES : 6.0, 7.0, 8 - ------------------------------------------------------------------------- DESCRIPTION Samba is a server that provides SMB services such as file and printer sharing for other SMB clients, such as Windows(R). Steve Langasek and Eloy Paris discovered a vulnerability in Samba versions 2.2.2 to 2.2.6 which may allow a remote attacker to execute arbitrary code in the server context. The vulnerability, which is a buffer overflow in a function used to decrypt hashed passwords, can be exploited by an attacker when authenticating a valid account in the samba server. In order to sucessfully run arbitrary code, the overflow must be crafted such that converting a DOS codepage string to little endian UCS2 unicode translates into an executable block of code. This update also adds other fixes for potential buffer overflows from samba 2.2.7 that are not part of the standard patch supplied by the samba authors in their announcement[1]. The samba package distributed in Conectiva Linux 6.0 (samba-2.0.9) is not vulnerable to the announced buffer overflow, but it is being upgraded with these aditional fixes. SOLUTION All samba users should upgrade their packages immediately. This update will automatically restart the samba service if it is already running. REFERENCES: 1.http://us1.samba.org/samba/whatsnew/samba-2.2.7.html DIRECT DOWNLOAD LINKS TO THE UPDATED PACKAGES ftp://atualizacoes.conectiva.com.br/6.0/RPMS/samba-2.0.9-2U60_2cl.i386.rpm ftp://atualizacoes.conectiva.com.br/6.0/RPMS/samba-clients-2.0.9-2U60_2cl.i386.rpm ftp://atualizacoes.conectiva.com.br/6.0/RPMS/samba-doc-2.0.9-2U60_2cl.i386.rpm ftp://atualizacoes.conectiva.com.br/6.0/RPMS/samba-swat-2.0.9-2U60_2cl.i386.rpm ftp://atualizacoes.conectiva.com.br/6.0/SRPMS/samba-2.0.9-2U60_2cl.src.rpm ftp://atualizacoes.conectiva.com.br/7.0/RPMS/samba-2.2.1a-1U70_2cl.i386.rpm ftp://atualizacoes.conectiva.com.br/7.0/RPMS/samba-clients-2.2.1a-1U70_2cl.i386.rpm ftp://atualizacoes.conectiva.com.br/7.0/RPMS/samba-codepagesource-2.2.1a-1U70_2cl.i386.rpm ftp://atualizacoes.conectiva.com.br/7.0/RPMS/samba-common-2.2.1a-1U70_2cl.i386.rpm ftp://atualizacoes.conectiva.com.br/7.0/RPMS/samba-doc-2.2.1a-1U70_2cl.i386.rpm ftp://atualizacoes.conectiva.com.br/7.0/RPMS/samba-swat-2.2.1a-1U70_2cl.i386.rpm ftp://atualizacoes.conectiva.com.br/7.0/SRPMS/samba-2.2.1a-1U70_2cl.src.rpm ftp://atualizacoes.conectiva.com.br/8/RPMS/samba-2.2.3a-2U80_1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/8/RPMS/samba-clients-2.2.3a-2U80_1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/8/RPMS/samba-codepagesource-2.2.3a-2U80_1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/8/RPMS/samba-common-2.2.3a-2U80_1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/8/RPMS/samba-doc-2.2.3a-2U80_1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/8/RPMS/samba-swat-2.2.3a-2U80_1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/8/SRPMS/samba-2.2.3a-2U80_1cl.src.rpm ADDITIONAL INSTRUCTIONS Users of Conectiva Linux version 6.0 or higher may use apt to perform upgrades of RPM packages: - add the following line to /etc/apt/sources.list if it is not there yet (you may also use linuxconf to do this): rpm [cncbr] ftp://atualizacoes.conectiva.com.br 6.0/conectiva updates (replace 6.0 with the correct version number if you are not running CL6.0) - run: apt-get update - after that, execute: apt-get upgrade Detailed instructions reagarding the use of apt and upgrade examples can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en - ------------------------------------------------------------------------- All packages are signed with Conectiva's GPG key. The key and instructions on how to import it can be found at http://distro.conectiva.com.br/seguranca/chave/?idioma=en Instructions on how to check the signatures of the RPM packages can be found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en - ------------------------------------------------------------------------- All our advisories and generic update instructions can be viewed at http://distro.conectiva.com.br/atualizacoes/?idioma=en - ------------------------------------------------------------------------- subscribe: conectiva-updates-subscribeat_private unsubscribe: conectiva-updates-unsubscribeat_private -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE93nQm42jd0JmAcZARArgCAJ9YPRJ1FpbqRjsEGxzJyNwFVpx+5wCghRqK z0/Pjh2DW/QHKDirF+aPSMM= =YuUd -----END PGP SIGNATURE-----
This archive was generated by hypermail 2b30 : Sat Nov 23 2002 - 13:32:34 PST