Debian-Sicherheitsankündigung

DSA-280-1 samba -- Pufferüberlauf

Datum des Berichts:

07. Apr 2003

Betroffene Pakete:

Verwundbar:

Sicherheitsdatenbanken-Referenzen:

In der Bugtraq-Datenbank (bei SecurityFocus): BugTraq ID 7294, BugTraq ID 7295.
In Mitres CVE-Verzeichnis: CVE-2003-0201, CVE-2003-0196.
CERTs Verwundbarkeiten, Hinweise und Ereignis-Notizen: VU#267873.

Weitere Informationen:

Digital Defense, Inc. hat das Samba-Team von einer ernsten Verwundbarkeit in Samba informiert, einem LanManager-ähnlichem Datei- und Druck-Server für Unix. Diese Verwundbarkeit kann dazu führen, dass ein anonymer Benutzer root-Zugriff auf einen Rechner erlangt, der Samba anbietet. Ein Ausbeutungsprogramm für dieses Problem ist bereits im Umlauf und in Verwendung.

Da die Pakete für Potato ziemlich alt sind, ist es wahrscheinlich, dass sie weitere sicherheitsrelevante Fehler enthalten, von denen wir nicht wissen. Es wird Ihnen daher empfohlen, Ihre Systeme, auf denen Samba läuft, bald auf Woody zu aktualisieren.

Inoffizielle zurückportierte Pakete von den Samba-Betreuern für die Version 2.2.8 von Samba für Woody sind unter ~peloy und ~vorlon verfügbar.

Für die stable Distribution (Woody) wurde dieses Problem in Version 2.2.3a-12.3 behoben.

Für die alte stable Distribution (Potato) wurde dieses Problem in Version 2.0.7-5.1 behoben.

Die unstable Distribution (Sid) ist nicht von diesem Problem betroffen, da sie bereits Pakete der Version 3.0 enthält.

Wir empfehlen Ihnen, Ihre Samba-Pakete unverzüglich zu aktualisieren.

Behoben in:

Debian GNU/Linux 2.2 (potato)

Quellcode:: http://security.debian.org/pool/updates/main/s/samba/samba_2.0.7-5.1.dsc; http://security.debian.org/pool/updates/main/s/samba/samba_2.0.7-5.1.diff.gz; http://security.debian.org/pool/updates/main/s/samba/samba_2.0.7.orig.tar.gz
Architektur-unabhängige Dateien:: http://security.debian.org/pool/updates/main/s/samba/samba-doc_2.0.7-5.1_all.deb
Alpha:: http://security.debian.org/pool/updates/main/s/samba/samba_2.0.7-5.1_alpha.deb; http://security.debian.org/pool/updates/main/s/samba/samba-common_2.0.7-5.1_alpha.deb; http://security.debian.org/pool/updates/main/s/samba/smbclient_2.0.7-5.1_alpha.deb; http://security.debian.org/pool/updates/main/s/samba/smbfs_2.0.7-5.1_alpha.deb; http://security.debian.org/pool/updates/main/s/samba/swat_2.0.7-5.1_alpha.deb
ARM:: http://security.debian.org/pool/updates/main/s/samba/samba_2.0.7-5.1_arm.deb; http://security.debian.org/pool/updates/main/s/samba/samba-common_2.0.7-5.1_arm.deb; http://security.debian.org/pool/updates/main/s/samba/smbclient_2.0.7-5.1_arm.deb; http://security.debian.org/pool/updates/main/s/samba/smbfs_2.0.7-5.1_arm.deb; http://security.debian.org/pool/updates/main/s/samba/swat_2.0.7-5.1_arm.deb
Intel IA-32:: http://security.debian.org/pool/updates/main/s/samba/samba_2.0.7-5.1_i386.deb; http://security.debian.org/pool/updates/main/s/samba/samba-common_2.0.7-5.1_i386.deb; http://security.debian.org/pool/updates/main/s/samba/smbclient_2.0.7-5.1_i386.deb; http://security.debian.org/pool/updates/main/s/samba/smbfs_2.0.7-5.1_i386.deb; http://security.debian.org/pool/updates/main/s/samba/swat_2.0.7-5.1_i386.deb
Motorola 680x0:: http://security.debian.org/pool/updates/main/s/samba/samba_2.0.7-5.1_m68k.deb; http://security.debian.org/pool/updates/main/s/samba/samba-common_2.0.7-5.1_m68k.deb; http://security.debian.org/pool/updates/main/s/samba/smbclient_2.0.7-5.1_m68k.deb; http://security.debian.org/pool/updates/main/s/samba/smbfs_2.0.7-5.1_m68k.deb; http://security.debian.org/pool/updates/main/s/samba/swat_2.0.7-5.1_m68k.deb
PowerPC:: http://security.debian.org/pool/updates/main/s/samba/samba_2.0.7-5.1_powerpc.deb; http://security.debian.org/pool/updates/main/s/samba/samba-common_2.0.7-5.1_powerpc.deb; http://security.debian.org/pool/updates/main/s/samba/smbclient_2.0.7-5.1_powerpc.deb; http://security.debian.org/pool/updates/main/s/samba/smbfs_2.0.7-5.1_powerpc.deb; http://security.debian.org/pool/updates/main/s/samba/swat_2.0.7-5.1_powerpc.deb
Sun Sparc:: http://security.debian.org/pool/updates/main/s/samba/samba_2.0.7-5.1_sparc.deb; http://security.debian.org/pool/updates/main/s/samba/samba-common_2.0.7-5.1_sparc.deb; http://security.debian.org/pool/updates/main/s/samba/smbclient_2.0.7-5.1_sparc.deb; http://security.debian.org/pool/updates/main/s/samba/smbfs_2.0.7-5.1_sparc.deb; http://security.debian.org/pool/updates/main/s/samba/swat_2.0.7-5.1_sparc.deb

Debian GNU/Linux 3.0 (woody)

Quellcode:: http://security.debian.org/pool/updates/main/s/samba/samba_2.2.3a-12.3.dsc; http://security.debian.org/pool/updates/main/s/samba/samba_2.2.3a-12.3.diff.gz; http://security.debian.org/pool/updates/main/s/samba/samba_2.2.3a.orig.tar.gz
Architektur-unabhängige Dateien:: http://security.debian.org/pool/updates/main/s/samba/samba-doc_2.2.3a-12.3_all.deb
Alpha:: http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_2.2.3a-12.3_alpha.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient_2.2.3a-12.3_alpha.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_2.2.3a-12.3_alpha.deb; http://security.debian.org/pool/updates/main/s/samba/samba_2.2.3a-12.3_alpha.deb; http://security.debian.org/pool/updates/main/s/samba/samba-common_2.2.3a-12.3_alpha.deb; http://security.debian.org/pool/updates/main/s/samba/smbclient_2.2.3a-12.3_alpha.deb; http://security.debian.org/pool/updates/main/s/samba/smbfs_2.2.3a-12.3_alpha.deb; http://security.debian.org/pool/updates/main/s/samba/swat_2.2.3a-12.3_alpha.deb; http://security.debian.org/pool/updates/main/s/samba/winbind_2.2.3a-12.3_alpha.deb
ARM:: http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_2.2.3a-12.3_arm.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient_2.2.3a-12.3_arm.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_2.2.3a-12.3_arm.deb; http://security.debian.org/pool/updates/main/s/samba/samba_2.2.3a-12.3_arm.deb; http://security.debian.org/pool/updates/main/s/samba/samba-common_2.2.3a-12.3_arm.deb; http://security.debian.org/pool/updates/main/s/samba/smbclient_2.2.3a-12.3_arm.deb; http://security.debian.org/pool/updates/main/s/samba/smbfs_2.2.3a-12.3_arm.deb; http://security.debian.org/pool/updates/main/s/samba/swat_2.2.3a-12.3_arm.deb; http://security.debian.org/pool/updates/main/s/samba/winbind_2.2.3a-12.3_arm.deb
Intel IA-32:: http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_2.2.3a-12.3_i386.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient_2.2.3a-12.3_i386.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_2.2.3a-12.3_i386.deb; http://security.debian.org/pool/updates/main/s/samba/samba_2.2.3a-12.3_i386.deb; http://security.debian.org/pool/updates/main/s/samba/samba-common_2.2.3a-12.3_i386.deb; http://security.debian.org/pool/updates/main/s/samba/smbclient_2.2.3a-12.3_i386.deb; http://security.debian.org/pool/updates/main/s/samba/smbfs_2.2.3a-12.3_i386.deb; http://security.debian.org/pool/updates/main/s/samba/swat_2.2.3a-12.3_i386.deb; http://security.debian.org/pool/updates/main/s/samba/winbind_2.2.3a-12.3_i386.deb
Intel IA-64:: http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_2.2.3a-12.3_ia64.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient_2.2.3a-12.3_ia64.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_2.2.3a-12.3_ia64.deb; http://security.debian.org/pool/updates/main/s/samba/samba_2.2.3a-12.3_ia64.deb; http://security.debian.org/pool/updates/main/s/samba/samba-common_2.2.3a-12.3_ia64.deb; http://security.debian.org/pool/updates/main/s/samba/smbclient_2.2.3a-12.3_ia64.deb; http://security.debian.org/pool/updates/main/s/samba/smbfs_2.2.3a-12.3_ia64.deb; http://security.debian.org/pool/updates/main/s/samba/swat_2.2.3a-12.3_ia64.deb; http://security.debian.org/pool/updates/main/s/samba/winbind_2.2.3a-12.3_ia64.deb
HPPA:: http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_2.2.3a-12.3_hppa.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient_2.2.3a-12.3_hppa.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_2.2.3a-12.3_hppa.deb; http://security.debian.org/pool/updates/main/s/samba/samba_2.2.3a-12.3_hppa.deb; http://security.debian.org/pool/updates/main/s/samba/samba-common_2.2.3a-12.3_hppa.deb; http://security.debian.org/pool/updates/main/s/samba/smbclient_2.2.3a-12.3_hppa.deb; http://security.debian.org/pool/updates/main/s/samba/smbfs_2.2.3a-12.3_hppa.deb; http://security.debian.org/pool/updates/main/s/samba/swat_2.2.3a-12.3_hppa.deb; http://security.debian.org/pool/updates/main/s/samba/winbind_2.2.3a-12.3_hppa.deb
Motorola 680x0:: http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_2.2.3a-12.3_m68k.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient_2.2.3a-12.3_m68k.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_2.2.3a-12.3_m68k.deb; http://security.debian.org/pool/updates/main/s/samba/samba_2.2.3a-12.3_m68k.deb; http://security.debian.org/pool/updates/main/s/samba/samba-common_2.2.3a-12.3_m68k.deb; http://security.debian.org/pool/updates/main/s/samba/smbclient_2.2.3a-12.3_m68k.deb; http://security.debian.org/pool/updates/main/s/samba/smbfs_2.2.3a-12.3_m68k.deb; http://security.debian.org/pool/updates/main/s/samba/swat_2.2.3a-12.3_m68k.deb; http://security.debian.org/pool/updates/main/s/samba/winbind_2.2.3a-12.3_m68k.deb
Big endian MIPS:: http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_2.2.3a-12.3_mips.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient_2.2.3a-12.3_mips.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_2.2.3a-12.3_mips.deb; http://security.debian.org/pool/updates/main/s/samba/samba_2.2.3a-12.3_mips.deb; http://security.debian.org/pool/updates/main/s/samba/samba-common_2.2.3a-12.3_mips.deb; http://security.debian.org/pool/updates/main/s/samba/smbclient_2.2.3a-12.3_mips.deb; http://security.debian.org/pool/updates/main/s/samba/smbfs_2.2.3a-12.3_mips.deb; http://security.debian.org/pool/updates/main/s/samba/swat_2.2.3a-12.3_mips.deb; http://security.debian.org/pool/updates/main/s/samba/winbind_2.2.3a-12.3_mips.deb
Little endian MIPS:: http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_2.2.3a-12.3_mipsel.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient_2.2.3a-12.3_mipsel.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_2.2.3a-12.3_mipsel.deb; http://security.debian.org/pool/updates/main/s/samba/samba_2.2.3a-12.3_mipsel.deb; http://security.debian.org/pool/updates/main/s/samba/samba-common_2.2.3a-12.3_mipsel.deb; http://security.debian.org/pool/updates/main/s/samba/smbclient_2.2.3a-12.3_mipsel.deb; http://security.debian.org/pool/updates/main/s/samba/smbfs_2.2.3a-12.3_mipsel.deb; http://security.debian.org/pool/updates/main/s/samba/swat_2.2.3a-12.3_mipsel.deb; http://security.debian.org/pool/updates/main/s/samba/winbind_2.2.3a-12.3_mipsel.deb
PowerPC:: http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_2.2.3a-12.3_powerpc.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient_2.2.3a-12.3_powerpc.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_2.2.3a-12.3_powerpc.deb; http://security.debian.org/pool/updates/main/s/samba/samba_2.2.3a-12.3_powerpc.deb; http://security.debian.org/pool/updates/main/s/samba/samba-common_2.2.3a-12.3_powerpc.deb; http://security.debian.org/pool/updates/main/s/samba/smbclient_2.2.3a-12.3_powerpc.deb; http://security.debian.org/pool/updates/main/s/samba/smbfs_2.2.3a-12.3_powerpc.deb; http://security.debian.org/pool/updates/main/s/samba/swat_2.2.3a-12.3_powerpc.deb; http://security.debian.org/pool/updates/main/s/samba/winbind_2.2.3a-12.3_powerpc.deb
IBM S/390:: http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_2.2.3a-12.3_s390.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient_2.2.3a-12.3_s390.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_2.2.3a-12.3_s390.deb; http://security.debian.org/pool/updates/main/s/samba/samba_2.2.3a-12.3_s390.deb; http://security.debian.org/pool/updates/main/s/samba/samba-common_2.2.3a-12.3_s390.deb; http://security.debian.org/pool/updates/main/s/samba/smbclient_2.2.3a-12.3_s390.deb; http://security.debian.org/pool/updates/main/s/samba/smbfs_2.2.3a-12.3_s390.deb; http://security.debian.org/pool/updates/main/s/samba/swat_2.2.3a-12.3_s390.deb; http://security.debian.org/pool/updates/main/s/samba/winbind_2.2.3a-12.3_s390.deb
Sun Sparc:: http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_2.2.3a-12.3_sparc.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient_2.2.3a-12.3_sparc.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_2.2.3a-12.3_sparc.deb; http://security.debian.org/pool/updates/main/s/samba/samba_2.2.3a-12.3_sparc.deb; http://security.debian.org/pool/updates/main/s/samba/samba-common_2.2.3a-12.3_sparc.deb; http://security.debian.org/pool/updates/main/s/samba/smbclient_2.2.3a-12.3_sparc.deb; http://security.debian.org/pool/updates/main/s/samba/smbfs_2.2.3a-12.3_sparc.deb; http://security.debian.org/pool/updates/main/s/samba/swat_2.2.3a-12.3_sparc.deb; http://security.debian.org/pool/updates/main/s/samba/winbind_2.2.3a-12.3_sparc.deb

MD5-Prüfsummen der aufgeführten Dateien stehen in der ursprünglichen Sicherheitsankündigung zur Verfügung.