Debian Security Advisory
DSA-463-1 samba -- privilege escalation
- Date Reported:
- 12 Mar 2004
- Affected Packages:
- samba
- Vulnerable:
- Yes
- Security database references:
- In the Bugtraq database (at SecurityFocus): BugTraq ID 9619.
In Mitre's CVE dictionary: CVE-2004-0186. - More information:
-
Samba, a LanManager-like file and printer server for Unix, was found to contain a vulnerability whereby a local user could use the "smbmnt" utility, which is setuid root, to mount a file share from a remote server which contained setuid programs under the control of the user. These programs could then be executed to gain privileges on the local system.
For the current stable distribution (woody) this problem has been fixed in version 2.2.3a-13.
For the unstable distribution (sid) this problem has been fixed in version 3.0.2-2.
We recommend that you update your samba package.
- Fixed in:
-
Debian GNU/Linux 3.0 (woody)
- Source:
- http://security.debian.org/pool/updates/main/s/samba/samba_2.2.3a-13.dsc
- http://security.debian.org/pool/updates/main/s/samba/samba_2.2.3a-13.diff.gz
- http://security.debian.org/pool/updates/main/s/samba/samba_2.2.3a.orig.tar.gz
- http://security.debian.org/pool/updates/main/s/samba/samba_2.2.3a-13.diff.gz
- Architecture-independent component:
- http://security.debian.org/pool/updates/main/s/samba/samba-doc_2.2.3a-13_all.deb
- Alpha:
- http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_2.2.3a-13_alpha.deb
- http://security.debian.org/pool/updates/main/s/samba/libsmbclient_2.2.3a-13_alpha.deb
- http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_2.2.3a-13_alpha.deb
- http://security.debian.org/pool/updates/main/s/samba/samba_2.2.3a-13_alpha.deb
- http://security.debian.org/pool/updates/main/s/samba/samba-common_2.2.3a-13_alpha.deb
- http://security.debian.org/pool/updates/main/s/samba/smbclient_2.2.3a-13_alpha.deb
- http://security.debian.org/pool/updates/main/s/samba/smbfs_2.2.3a-13_alpha.deb
- http://security.debian.org/pool/updates/main/s/samba/swat_2.2.3a-13_alpha.deb
- http://security.debian.org/pool/updates/main/s/samba/winbind_2.2.3a-13_alpha.deb
- http://security.debian.org/pool/updates/main/s/samba/libsmbclient_2.2.3a-13_alpha.deb
- ARM:
- http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_2.2.3a-13_arm.deb
- http://security.debian.org/pool/updates/main/s/samba/libsmbclient_2.2.3a-13_arm.deb
- http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_2.2.3a-13_arm.deb
- http://security.debian.org/pool/updates/main/s/samba/samba_2.2.3a-13_arm.deb
- http://security.debian.org/pool/updates/main/s/samba/samba-common_2.2.3a-13_arm.deb
- http://security.debian.org/pool/updates/main/s/samba/smbclient_2.2.3a-13_arm.deb
- http://security.debian.org/pool/updates/main/s/samba/smbfs_2.2.3a-13_arm.deb
- http://security.debian.org/pool/updates/main/s/samba/swat_2.2.3a-13_arm.deb
- http://security.debian.org/pool/updates/main/s/samba/winbind_2.2.3a-13_arm.deb
- http://security.debian.org/pool/updates/main/s/samba/libsmbclient_2.2.3a-13_arm.deb
- Intel IA-32:
- http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_2.2.3a-13_i386.deb
- http://security.debian.org/pool/updates/main/s/samba/libsmbclient_2.2.3a-13_i386.deb
- http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_2.2.3a-13_i386.deb
- http://security.debian.org/pool/updates/main/s/samba/samba_2.2.3a-13_i386.deb
- http://security.debian.org/pool/updates/main/s/samba/samba-common_2.2.3a-13_i386.deb
- http://security.debian.org/pool/updates/main/s/samba/smbclient_2.2.3a-13_i386.deb
- http://security.debian.org/pool/updates/main/s/samba/smbfs_2.2.3a-13_i386.deb
- http://security.debian.org/pool/updates/main/s/samba/swat_2.2.3a-13_i386.deb
- http://security.debian.org/pool/updates/main/s/samba/winbind_2.2.3a-13_i386.deb
- http://security.debian.org/pool/updates/main/s/samba/libsmbclient_2.2.3a-13_i386.deb
- Intel IA-64:
- http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_2.2.3a-13_ia64.deb
- http://security.debian.org/pool/updates/main/s/samba/libsmbclient_2.2.3a-13_ia64.deb
- http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_2.2.3a-13_ia64.deb
- http://security.debian.org/pool/updates/main/s/samba/samba_2.2.3a-13_ia64.deb
- http://security.debian.org/pool/updates/main/s/samba/samba-common_2.2.3a-13_ia64.deb
- http://security.debian.org/pool/updates/main/s/samba/smbclient_2.2.3a-13_ia64.deb
- http://security.debian.org/pool/updates/main/s/samba/smbfs_2.2.3a-13_ia64.deb
- http://security.debian.org/pool/updates/main/s/samba/swat_2.2.3a-13_ia64.deb
- http://security.debian.org/pool/updates/main/s/samba/winbind_2.2.3a-13_ia64.deb
- http://security.debian.org/pool/updates/main/s/samba/libsmbclient_2.2.3a-13_ia64.deb
- HPPA:
- http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_2.2.3a-13_hppa.deb
- http://security.debian.org/pool/updates/main/s/samba/libsmbclient_2.2.3a-13_hppa.deb
- http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_2.2.3a-13_hppa.deb
- http://security.debian.org/pool/updates/main/s/samba/samba_2.2.3a-13_hppa.deb
- http://security.debian.org/pool/updates/main/s/samba/samba-common_2.2.3a-13_hppa.deb
- http://security.debian.org/pool/updates/main/s/samba/smbclient_2.2.3a-13_hppa.deb
- http://security.debian.org/pool/updates/main/s/samba/smbfs_2.2.3a-13_hppa.deb
- http://security.debian.org/pool/updates/main/s/samba/swat_2.2.3a-13_hppa.deb
- http://security.debian.org/pool/updates/main/s/samba/winbind_2.2.3a-13_hppa.deb
- http://security.debian.org/pool/updates/main/s/samba/libsmbclient_2.2.3a-13_hppa.deb
- Motorola 680x0:
- http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_2.2.3a-13_m68k.deb
- http://security.debian.org/pool/updates/main/s/samba/libsmbclient_2.2.3a-13_m68k.deb
- http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_2.2.3a-13_m68k.deb
- http://security.debian.org/pool/updates/main/s/samba/samba_2.2.3a-13_m68k.deb
- http://security.debian.org/pool/updates/main/s/samba/samba-common_2.2.3a-13_m68k.deb
- http://security.debian.org/pool/updates/main/s/samba/smbclient_2.2.3a-13_m68k.deb
- http://security.debian.org/pool/updates/main/s/samba/smbfs_2.2.3a-13_m68k.deb
- http://security.debian.org/pool/updates/main/s/samba/swat_2.2.3a-13_m68k.deb
- http://security.debian.org/pool/updates/main/s/samba/winbind_2.2.3a-13_m68k.deb
- http://security.debian.org/pool/updates/main/s/samba/libsmbclient_2.2.3a-13_m68k.deb
- Big endian MIPS:
- http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_2.2.3a-13_mips.deb
- http://security.debian.org/pool/updates/main/s/samba/libsmbclient_2.2.3a-13_mips.deb
- http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_2.2.3a-13_mips.deb
- http://security.debian.org/pool/updates/main/s/samba/samba_2.2.3a-13_mips.deb
- http://security.debian.org/pool/updates/main/s/samba/samba-common_2.2.3a-13_mips.deb
- http://security.debian.org/pool/updates/main/s/samba/smbclient_2.2.3a-13_mips.deb
- http://security.debian.org/pool/updates/main/s/samba/smbfs_2.2.3a-13_mips.deb
- http://security.debian.org/pool/updates/main/s/samba/swat_2.2.3a-13_mips.deb
- http://security.debian.org/pool/updates/main/s/samba/winbind_2.2.3a-13_mips.deb
- http://security.debian.org/pool/updates/main/s/samba/libsmbclient_2.2.3a-13_mips.deb
- Little endian MIPS:
- http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_2.2.3a-12.3_mipsel.deb
- http://security.debian.org/pool/updates/main/s/samba/libsmbclient_2.2.3a-12.3_mipsel.deb
- http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_2.2.3a-12.3_mipsel.deb
- http://security.debian.org/pool/updates/main/s/samba/samba_2.2.3a-12.3_mipsel.deb
- http://security.debian.org/pool/updates/main/s/samba/samba-common_2.2.3a-12.3_mipsel.deb
- http://security.debian.org/pool/updates/main/s/samba/smbclient_2.2.3a-12.3_mipsel.deb
- http://security.debian.org/pool/updates/main/s/samba/smbfs_2.2.3a-12.3_mipsel.deb
- http://security.debian.org/pool/updates/main/s/samba/swat_2.2.3a-12.3_mipsel.deb
- http://security.debian.org/pool/updates/main/s/samba/winbind_2.2.3a-12.3_mipsel.deb
- http://security.debian.org/pool/updates/main/s/samba/libsmbclient_2.2.3a-12.3_mipsel.deb
- PowerPC:
- http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_2.2.3a-13_powerpc.deb
- http://security.debian.org/pool/updates/main/s/samba/libsmbclient_2.2.3a-13_powerpc.deb
- http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_2.2.3a-13_powerpc.deb
- http://security.debian.org/pool/updates/main/s/samba/samba_2.2.3a-13_powerpc.deb
- http://security.debian.org/pool/updates/main/s/samba/samba-common_2.2.3a-13_powerpc.deb
- http://security.debian.org/pool/updates/main/s/samba/smbclient_2.2.3a-13_powerpc.deb
- http://security.debian.org/pool/updates/main/s/samba/smbfs_2.2.3a-13_powerpc.deb
- http://security.debian.org/pool/updates/main/s/samba/swat_2.2.3a-13_powerpc.deb
- http://security.debian.org/pool/updates/main/s/samba/winbind_2.2.3a-13_powerpc.deb
- http://security.debian.org/pool/updates/main/s/samba/libsmbclient_2.2.3a-13_powerpc.deb
- IBM S/390:
- http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_2.2.3a-13_s390.deb
- http://security.debian.org/pool/updates/main/s/samba/libsmbclient_2.2.3a-13_s390.deb
- http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_2.2.3a-13_s390.deb
- http://security.debian.org/pool/updates/main/s/samba/samba_2.2.3a-13_s390.deb
- http://security.debian.org/pool/updates/main/s/samba/samba-common_2.2.3a-13_s390.deb
- http://security.debian.org/pool/updates/main/s/samba/smbclient_2.2.3a-13_s390.deb
- http://security.debian.org/pool/updates/main/s/samba/smbfs_2.2.3a-13_s390.deb
- http://security.debian.org/pool/updates/main/s/samba/swat_2.2.3a-13_s390.deb
- http://security.debian.org/pool/updates/main/s/samba/winbind_2.2.3a-13_s390.deb
- http://security.debian.org/pool/updates/main/s/samba/libsmbclient_2.2.3a-13_s390.deb
- Sun Sparc:
- http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_2.2.3a-13_sparc.deb
- http://security.debian.org/pool/updates/main/s/samba/libsmbclient_2.2.3a-13_sparc.deb
- http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_2.2.3a-13_sparc.deb
- http://security.debian.org/pool/updates/main/s/samba/samba_2.2.3a-13_sparc.deb
- http://security.debian.org/pool/updates/main/s/samba/samba-common_2.2.3a-13_sparc.deb
- http://security.debian.org/pool/updates/main/s/samba/smbclient_2.2.3a-13_sparc.deb
- http://security.debian.org/pool/updates/main/s/samba/smbfs_2.2.3a-13_sparc.deb
- http://security.debian.org/pool/updates/main/s/samba/swat_2.2.3a-13_sparc.deb
- http://security.debian.org/pool/updates/main/s/samba/winbind_2.2.3a-13_sparc.deb
- http://security.debian.org/pool/updates/main/s/samba/libsmbclient_2.2.3a-13_sparc.deb
MD5 checksums of the listed files are available in the original advisory.