Säkerhetsbulletin från Debian

DSA-2109-1 samba -- buffertspill

Rapporterat den:
2010-09-16
Berörda paket:
samba
Sårbara:
Ja
Referenser i säkerhetsdatabaser:
I Debians felrapporteringssystem: Fel 596891.
I Mitres CVE-förteckning: CVE-2010-3069.
Ytterligare information:

En sårbarhet har upptäckts i samba, en SMB/CIFS-fil-, utskrifts- och inloggningsserver för Unix.

Funktionen sid_parse() kontrollerar inte indatalängder korrekt vid läsning av en binär representation av ett Windows SID (Security ID). Detta tillåter en illvillig klient att skicka ett sid som kan orsaka ett spill i den stackvariabel som används för att lagra sid-datat i Samba smdb-servern. (CVE-2010-3069)

För den stabila utgåvan (Lenny) har detta problem rättats i version 3.2.5-4lenny13.

För uttestningsutgåvan (Squeeze) och den instabila utgåvan (Sid) kommer detta problem att rättas inom kort i version 3.5.5~dfsg-1.

Vi rekommenderar att ni uppgraderar era samba-paket. Paketen för mips-arkitekturen är inte inkluderade i denna uppgradering. De kommer släppas så snart de finns tillgängliga.

Rättat i:

Debian GNU/Linux 5.0 (lenny)

Källkod:
http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny13.dsc
http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5.orig.tar.gz
http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny13.diff.gz
Arkitekturoberoende komponent:
http://security.debian.org/pool/updates/main/s/samba/samba-doc-pdf_3.2.5-4lenny13_all.deb
http://security.debian.org/pool/updates/main/s/samba/samba-doc_3.2.5-4lenny13_all.deb
Alpha:
http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny13_alpha.deb
http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny13_alpha.deb
http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny13_alpha.deb
http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny13_alpha.deb
http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny13_alpha.deb
http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny13_alpha.deb
http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny13_alpha.deb
http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny13_alpha.deb
http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny13_alpha.deb
http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny13_alpha.deb
http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny13_alpha.deb
http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny13_alpha.deb
AMD64:
http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny13_amd64.deb
http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny13_amd64.deb
http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny13_amd64.deb
http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny13_amd64.deb
http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny13_amd64.deb
http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny13_amd64.deb
http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny13_amd64.deb
http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny13_amd64.deb
http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny13_amd64.deb
http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny13_amd64.deb
http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny13_amd64.deb
http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny13_amd64.deb
ARM:
http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny13_arm.deb
http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny13_arm.deb
http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny13_arm.deb
http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny13_arm.deb
http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny13_arm.deb
http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny13_arm.deb
http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny13_arm.deb
http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny13_arm.deb
http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny13_arm.deb
http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny13_arm.deb
http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny13_arm.deb
http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny13_arm.deb
ARM EABI:
http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny13_armel.deb
http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny13_armel.deb
http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny13_armel.deb
http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny13_armel.deb
http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny13_armel.deb
http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny13_armel.deb
http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny13_armel.deb
http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny13_armel.deb
http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny13_armel.deb
http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny13_armel.deb
http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny13_armel.deb
http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny13_armel.deb
HP Precision:
http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny13_hppa.deb
http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny13_hppa.deb
http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny13_hppa.deb
http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny13_hppa.deb
http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny13_hppa.deb
http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny13_hppa.deb
http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny13_hppa.deb
http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny13_hppa.deb
http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny13_hppa.deb
http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny13_hppa.deb
http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny13_hppa.deb
http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny13_hppa.deb
Intel IA-32:
http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny13_i386.deb
http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny13_i386.deb
http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny13_i386.deb
http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny13_i386.deb
http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny13_i386.deb
http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny13_i386.deb
http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny13_i386.deb
http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny13_i386.deb
http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny13_i386.deb
http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny13_i386.deb
http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny13_i386.deb
http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny13_i386.deb
Intel IA-64:
http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny13_ia64.deb
http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny13_ia64.deb
http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny13_ia64.deb
http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny13_ia64.deb
http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny13_ia64.deb
http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny13_ia64.deb
http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny13_ia64.deb
http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny13_ia64.deb
http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny13_ia64.deb
http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny13_ia64.deb
http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny13_ia64.deb
http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny13_ia64.deb
Little-endian MIPS:
http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny13_mipsel.deb
http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny13_mipsel.deb
http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny13_mipsel.deb
http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny13_mipsel.deb
http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny13_mipsel.deb
http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny13_mipsel.deb
http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny13_mipsel.deb
http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny13_mipsel.deb
http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny13_mipsel.deb
http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny13_mipsel.deb
http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny13_mipsel.deb
http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny13_mipsel.deb
PowerPC:
http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny13_powerpc.deb
http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny13_powerpc.deb
http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny13_powerpc.deb
http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny13_powerpc.deb
http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny13_powerpc.deb
http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny13_powerpc.deb
http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny13_powerpc.deb
http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny13_powerpc.deb
http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny13_powerpc.deb
http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny13_powerpc.deb
http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny13_powerpc.deb
http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny13_powerpc.deb
IBM S/390:
http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny13_s390.deb
http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny13_s390.deb
http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny13_s390.deb
http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny13_s390.deb
http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny13_s390.deb
http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny13_s390.deb
http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny13_s390.deb
http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny13_s390.deb
http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny13_s390.deb
http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny13_s390.deb
http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny13_s390.deb
http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny13_s390.deb
Sun Sparc:
http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny13_sparc.deb
http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny13_sparc.deb
http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny13_sparc.deb
http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny13_sparc.deb
http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny13_sparc.deb
http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny13_sparc.deb
http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny13_sparc.deb
http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny13_sparc.deb
http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny13_sparc.deb
http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny13_sparc.deb
http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny13_sparc.deb
http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny13_sparc.deb

MD5-kontrollsummor för dessa filer finns i originalbulletinen.