Debians sikkerhedsbulletin

DSA-065-1 samba -- fjern-filtilføjelse/oprettelse

Rapporteret den:

23. jun 2001

Berørte pakker:

samba

Sårbar:

Referencer i sikkerhedsdatabaser:

I Bugtraq-databasen (hos SecurityFocus): BugTraq-id 2927.
I Mitres CVE-ordbog: CVE-2001-1162.

Yderligere oplysninger:

Michal Zalewski opdagede at Samba ikke validerer NetBIOS-navne korrekt fra fjern-maskiner.

I sig selv er det ikke et problem, bortset fra hvis Samba er sat op til at skrive log-filer til en fil der indeholder NetBIOS-navnet på den fjerne maskine ved at anvende `%m'-makroen `log file'-kommandoen. I det tilfælde kunne en angriber anvende et NetBIOS-navn som '../tmp/evil'. Hvis log-filen var sat til "/var/log/samba/%s" ville Samba da skrive i /var/tmp/evil.

Da NetBIOS-navnet er begrænset til 15 tegn og `log file'-kommandoen kunne have en extension til filnavnet er resultatet af dette begrænset. Men hvis angriberen også er i stand til at oprette symbolske links på Samba-serveren, så ville vedkommende kunne snyde Samba til at tilføje valgfrie data til alle filer i filsystemet, som Samba har skriveadgang til.

Debian GNU/Linux' Samba-pakke har en sikker opsætning og er ikke sårbar.

På systemer der er såbare kan man som en midlertidig løsning ændre alle forekomster af `%m'-makroen i smb.conf til `%l' og genstarte Samba.

Dette er rettet i version 2.0.7-3.4 og vi anbefaler at du omgående opgraderer din Samba-pakke.

Rettet i:

Debian GNU/Linux 2.2 (potato)

Kildekode:: http://security.debian.org/dists/stable/updates/main/source/samba_2.0.7-3.4.diff.gz; http://security.debian.org/dists/stable/updates/main/source/samba_2.0.7-3.4.dsc; http://security.debian.org/dists/stable/updates/main/source/samba_2.0.7.orig.tar.gz
Arkitekturuafhængig komponent:: http://security.debian.org/dists/stable/updates/main/binary-all/samba-doc_2.0.7-3.4_all.deb
Alpha:: http://security.debian.org/dists/stable/updates/main/binary-alpha/samba-common_2.0.7-3.4_alpha.deb; http://security.debian.org/dists/stable/updates/main/binary-alpha/samba_2.0.7-3.4_alpha.deb; http://security.debian.org/dists/stable/updates/main/binary-alpha/smbclient_2.0.7-3.4_alpha.deb; http://security.debian.org/dists/stable/updates/main/binary-alpha/smbfs_2.0.7-3.4_alpha.deb; http://security.debian.org/dists/stable/updates/main/binary-alpha/swat_2.0.7-3.4_alpha.deb
ARM:: http://security.debian.org/dists/stable/updates/main/binary-arm/samba-common_2.0.7-3.4_arm.deb; http://security.debian.org/dists/stable/updates/main/binary-arm/samba_2.0.7-3.4_arm.deb; http://security.debian.org/dists/stable/updates/main/binary-arm/smbclient_2.0.7-3.4_arm.deb; http://security.debian.org/dists/stable/updates/main/binary-arm/smbfs_2.0.7-3.4_arm.deb; http://security.debian.org/dists/stable/updates/main/binary-arm/swat_2.0.7-3.4_arm.deb
Intel IA-32:: http://security.debian.org/dists/stable/updates/main/binary-i386/samba-common_2.0.7-3.4_i386.deb; http://security.debian.org/dists/stable/updates/main/binary-i386/samba_2.0.7-3.4_i386.deb; http://security.debian.org/dists/stable/updates/main/binary-i386/smbclient_2.0.7-3.4_i386.deb; http://security.debian.org/dists/stable/updates/main/binary-i386/smbfs_2.0.7-3.4_i386.deb; http://security.debian.org/dists/stable/updates/main/binary-i386/swat_2.0.7-3.4_i386.deb
Motorola 680x0:: http://security.debian.org/dists/stable/updates/main/binary-m68k/samba-common_2.0.7-3.4_m68k.deb; http://security.debian.org/dists/stable/updates/main/binary-m68k/samba_2.0.7-3.4_m68k.deb; http://security.debian.org/dists/stable/updates/main/binary-m68k/smbclient_2.0.7-3.4_m68k.deb; http://security.debian.org/dists/stable/updates/main/binary-m68k/smbfs_2.0.7-3.4_m68k.deb; http://security.debian.org/dists/stable/updates/main/binary-m68k/swat_2.0.7-3.4_m68k.deb
PowerPC:: http://security.debian.org/dists/stable/updates/main/binary-powerpc/samba-common_2.0.7-3.4_powerpc.deb; http://security.debian.org/dists/stable/updates/main/binary-powerpc/samba_2.0.7-3.4_powerpc.deb; http://security.debian.org/dists/stable/updates/main/binary-powerpc/smbclient_2.0.7-3.4_powerpc.deb; http://security.debian.org/dists/stable/updates/main/binary-powerpc/smbfs_2.0.7-3.4_powerpc.deb; http://security.debian.org/dists/stable/updates/main/binary-powerpc/swat_2.0.7-3.4_powerpc.deb
Sun Sparc:: http://security.debian.org/dists/stable/updates/main/binary-sparc/samba-common_2.0.7-3.4_sparc.deb; http://security.debian.org/dists/stable/updates/main/binary-sparc/samba_2.0.7-3.4_sparc.deb; http://security.debian.org/dists/stable/updates/main/binary-sparc/smbclient_2.0.7-3.4_sparc.deb; http://security.debian.org/dists/stable/updates/main/binary-sparc/smbfs_2.0.7-3.4_sparc.deb; http://security.debian.org/dists/stable/updates/main/binary-sparc/swat_2.0.7-3.4_sparc.deb

MD5-kontrolsummer for de listede filer findes i den originale sikkerhedsbulletin.