Debian-Sicherheitsankündigung

DSA-1908-1 samba -- Mehrere Verwundbarkeiten

Datum des Berichts:

14. Okt 2009

Betroffene Pakete:

samba

Verwundbar:

Sicherheitsdatenbanken-Referenzen:

In Mitres CVE-Verzeichnis: CVE-2009-2948, CVE-2009-2906, CVE-2009-2813.

Weitere Informationen:

Mehrere Verwundbarkeiten wurden in Samba entdeckt, einer Implementation des SMB/CFIS-Protokolls für Unix-Systeme, das unter anderem Unterstützung für das plattformübergreifende Teilen von Dateien und Druckern mit anderen Betriebssystemen bietet. Das Common Vulnerabilities and Exposures-Projekt identifiziert die folgenden Probleme:

CVE-2009-2948
Das Werkzeug mount.cifs führt keine ausreichende Überprüfung der Dateizugriffsrechte durch, wenn es im verbose-Modus betrieben wird. Dadurch wird es lokalen Benutzern ermöglicht, den Inhalt von beliebigen Dateien teilweise einzusehen, indem sie diese Dateien als credentials-Datei angeben und versuchen, ein Samba-share einzuhängen.
CVE-2009-2906
Eine Antwort auf eine oplock-break-Benachrichtigung, die von Samba nicht erwartet wird, kann dazu führen, dass der Dienst sich in einer Endlosschleife aufhängt. Ein Angreifer kann dies mit einer speziell präparierten SMB-Anfrage für eine Diensteverweigerung (denial of service) ausnutzen.
CVE-2009-2813
Wenn kein Home-Verzeichnis für den Benutzer eingerichtet bzw. angegeben wurde, kann eine fehlende Fehlerbehandlung dazu führen, dass Dateien preisgegeben werden. Wenn das automatische [homes]-share aktiviert ist oder ein explizites share mit dem Benutzernamen erstellt wird, werden keine Zugriffbeschränkungen für diese shares von Samba erstellt. Dadurch kann ein Angreifer auf das gesamte Dateisystem ab dem Wurzelverzeichnis zugreifen.

Für die alte Stable-Distribution (Etch) wird dieses Problem bald behoben sein.

Für die Stable-Distribution (Lenny) wurde dieses Problem in Version 2:3.2.5-4lenny7 behoben.

Für die Testing-Distribution (Squeeze) wird dieses Problem bald behoben sein.

Für die Unstable-Distribution (Sid) wurde dieses Problem in Version 2:3.4.2-1 behoben.

Wir empfehlen Ihnen, Ihre samba-Pakete zu aktualisieren.

Behoben in:

Debian GNU/Linux 5.0 (lenny)

Quellcode:: http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny7.dsc; http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5.orig.tar.gz; http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny7.diff.gz
Architektur-unabhängige Dateien:: http://security.debian.org/pool/updates/main/s/samba/samba-doc_3.2.5-4lenny7_all.deb; http://security.debian.org/pool/updates/main/s/samba/samba-doc-pdf_3.2.5-4lenny7_all.deb
Alpha:: http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny7_alpha.deb; http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny7_alpha.deb; http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny7_alpha.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny7_alpha.deb; http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny7_alpha.deb; http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny7_alpha.deb; http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny7_alpha.deb; http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny7_alpha.deb; http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny7_alpha.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny7_alpha.deb; http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny7_alpha.deb; http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny7_alpha.deb
AMD64:: http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny7_amd64.deb; http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny7_amd64.deb; http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny7_amd64.deb; http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny7_amd64.deb; http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny7_amd64.deb; http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny7_amd64.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny7_amd64.deb; http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny7_amd64.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny7_amd64.deb; http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny7_amd64.deb; http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny7_amd64.deb; http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny7_amd64.deb
ARM:: http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny7_arm.deb; http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny7_arm.deb; http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny7_arm.deb; http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny7_arm.deb; http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny7_arm.deb; http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny7_arm.deb; http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny7_arm.deb; http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny7_arm.deb; http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny7_arm.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny7_arm.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny7_arm.deb; http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny7_arm.deb
ARM EABI:: http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny7_armel.deb; http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny7_armel.deb; http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny7_armel.deb; http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny7_armel.deb; http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny7_armel.deb; http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny7_armel.deb; http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny7_armel.deb; http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny7_armel.deb; http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny7_armel.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny7_armel.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny7_armel.deb; http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny7_armel.deb
HP Precision:: http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny7_hppa.deb; http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny7_hppa.deb; http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny7_hppa.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny7_hppa.deb; http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny7_hppa.deb; http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny7_hppa.deb; http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny7_hppa.deb; http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny7_hppa.deb; http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny7_hppa.deb; http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny7_hppa.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny7_hppa.deb; http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny7_hppa.deb
Intel IA-32:: http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny7_i386.deb; http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny7_i386.deb; http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny7_i386.deb; http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny7_i386.deb; http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny7_i386.deb; http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny7_i386.deb; http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny7_i386.deb; http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny7_i386.deb; http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny7_i386.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny7_i386.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny7_i386.deb; http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny7_i386.deb
Intel IA-64:: http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny7_ia64.deb; http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny7_ia64.deb; http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny7_ia64.deb; http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny7_ia64.deb; http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny7_ia64.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny7_ia64.deb; http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny7_ia64.deb; http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny7_ia64.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny7_ia64.deb; http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny7_ia64.deb; http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny7_ia64.deb; http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny7_ia64.deb
Big-endian MIPS:: http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny7_mips.deb; http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny7_mips.deb; http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny7_mips.deb; http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny7_mips.deb; http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny7_mips.deb; http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny7_mips.deb; http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny7_mips.deb; http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny7_mips.deb; http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny7_mips.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny7_mips.deb; http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny7_mips.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny7_mips.deb
Little-endian MIPS:: http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny7_mipsel.deb; http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny7_mipsel.deb; http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny7_mipsel.deb; http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny7_mipsel.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny7_mipsel.deb; http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny7_mipsel.deb; http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny7_mipsel.deb; http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny7_mipsel.deb; http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny7_mipsel.deb; http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny7_mipsel.deb; http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny7_mipsel.deb; http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny7_mipsel.deb
PowerPC:: http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny7_powerpc.deb; http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny7_powerpc.deb; http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny7_powerpc.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny7_powerpc.deb; http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny7_powerpc.deb; http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny7_powerpc.deb; http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny7_powerpc.deb; http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny7_powerpc.deb; http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny7_powerpc.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny7_powerpc.deb; http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny7_powerpc.deb; http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny7_powerpc.deb
IBM S/390:: http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny7_s390.deb; http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny7_s390.deb; http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny7_s390.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny7_s390.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny7_s390.deb; http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny7_s390.deb; http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny7_s390.deb; http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny7_s390.deb; http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny7_s390.deb; http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny7_s390.deb; http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny7_s390.deb; http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny7_s390.deb
Sun Sparc:: http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny7_sparc.deb; http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny7_sparc.deb; http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny7_sparc.deb; http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny7_sparc.deb; http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny7_sparc.deb; http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny7_sparc.deb; http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny7_sparc.deb; http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny7_sparc.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny7_sparc.deb; http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny7_sparc.deb; http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny7_sparc.deb; http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny7_sparc.deb

MD5-Prüfsummen der aufgeführten Dateien stehen in der ursprünglichen Sicherheitsankündigung zur Verfügung.