Debians sikkerhedsbulletin

DSA-2109-1 samba -- bufferoverløb

Rapporteret den:

16. sep 2010

Berørte pakker:

samba

Sårbar:

Referencer i sikkerhedsdatabaser:

I Debians fejlsporingssystem: Fejl 596891.
I Mitres CVE-ordbog: CVE-2010-3069.

Yderligere oplysninger:

En sårbarheder er opdaget i samba, en SMB/CIFS-fil-, print- og loginserver til Unix.

Funktionen sid_parse() kontrollerede ikke på korrekt vis længden på sine inddata, når der blev læst en binær repræsentation af Windows SID (Security ID). Dermed var det muligt for en ondsindet klient at sende en SID, der kunne få stakvariablen, som anvendes til at opbevare SID'en i Samba smbd-server, til at at løbe over. (CVE-2010-3069)

I den stabile distribution (lenny), er dette problem rettet i version 3.2.5-4lenny13.

I distributionen testing (squeeze) og i den ustabile distribution (sid), vil dette problem blive rettet i version 3.5.5~dfsg-1.

Vi anbefaler at du opgraderer dine samba packages. Pakkerne til arkitekturen mips er ikke indeholdt i denne opdatering. De vil blive frigivet så snart de er tilgængelige.

Rettet i:

Debian GNU/Linux 5.0 (lenny)

Kildekode:: http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny13.dsc; http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5.orig.tar.gz; http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny13.diff.gz
Arkitekturuafhængig komponent:: http://security.debian.org/pool/updates/main/s/samba/samba-doc-pdf_3.2.5-4lenny13_all.deb; http://security.debian.org/pool/updates/main/s/samba/samba-doc_3.2.5-4lenny13_all.deb
Alpha:: http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny13_alpha.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny13_alpha.deb; http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny13_alpha.deb; http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny13_alpha.deb; http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny13_alpha.deb; http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny13_alpha.deb; http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny13_alpha.deb; http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny13_alpha.deb; http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny13_alpha.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny13_alpha.deb; http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny13_alpha.deb; http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny13_alpha.deb
AMD64:: http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny13_amd64.deb; http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny13_amd64.deb; http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny13_amd64.deb; http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny13_amd64.deb; http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny13_amd64.deb; http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny13_amd64.deb; http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny13_amd64.deb; http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny13_amd64.deb; http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny13_amd64.deb; http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny13_amd64.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny13_amd64.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny13_amd64.deb
ARM:: http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny13_arm.deb; http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny13_arm.deb; http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny13_arm.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny13_arm.deb; http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny13_arm.deb; http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny13_arm.deb; http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny13_arm.deb; http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny13_arm.deb; http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny13_arm.deb; http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny13_arm.deb; http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny13_arm.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny13_arm.deb
ARM EABI:: http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny13_armel.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny13_armel.deb; http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny13_armel.deb; http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny13_armel.deb; http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny13_armel.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny13_armel.deb; http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny13_armel.deb; http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny13_armel.deb; http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny13_armel.deb; http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny13_armel.deb; http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny13_armel.deb; http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny13_armel.deb
HP Precision:: http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny13_hppa.deb; http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny13_hppa.deb; http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny13_hppa.deb; http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny13_hppa.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny13_hppa.deb; http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny13_hppa.deb; http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny13_hppa.deb; http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny13_hppa.deb; http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny13_hppa.deb; http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny13_hppa.deb; http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny13_hppa.deb; http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny13_hppa.deb
Intel IA-32:: http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny13_i386.deb; http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny13_i386.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny13_i386.deb; http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny13_i386.deb; http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny13_i386.deb; http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny13_i386.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny13_i386.deb; http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny13_i386.deb; http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny13_i386.deb; http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny13_i386.deb; http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny13_i386.deb; http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny13_i386.deb
Intel IA-64:: http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny13_ia64.deb; http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny13_ia64.deb; http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny13_ia64.deb; http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny13_ia64.deb; http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny13_ia64.deb; http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny13_ia64.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny13_ia64.deb; http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny13_ia64.deb; http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny13_ia64.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny13_ia64.deb; http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny13_ia64.deb; http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny13_ia64.deb
Little-endian MIPS:: http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny13_mipsel.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny13_mipsel.deb; http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny13_mipsel.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny13_mipsel.deb; http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny13_mipsel.deb; http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny13_mipsel.deb; http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny13_mipsel.deb; http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny13_mipsel.deb; http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny13_mipsel.deb; http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny13_mipsel.deb; http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny13_mipsel.deb; http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny13_mipsel.deb
PowerPC:: http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny13_powerpc.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny13_powerpc.deb; http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny13_powerpc.deb; http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny13_powerpc.deb; http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny13_powerpc.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny13_powerpc.deb; http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny13_powerpc.deb; http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny13_powerpc.deb; http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny13_powerpc.deb; http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny13_powerpc.deb; http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny13_powerpc.deb; http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny13_powerpc.deb
IBM S/390:: http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny13_s390.deb; http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny13_s390.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny13_s390.deb; http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny13_s390.deb; http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny13_s390.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny13_s390.deb; http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny13_s390.deb; http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny13_s390.deb; http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny13_s390.deb; http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny13_s390.deb; http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny13_s390.deb; http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny13_s390.deb
Sun Sparc:: http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny13_sparc.deb; http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny13_sparc.deb; http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny13_sparc.deb; http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny13_sparc.deb; http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny13_sparc.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny13_sparc.deb; http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny13_sparc.deb; http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny13_sparc.deb; http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny13_sparc.deb; http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny13_sparc.deb; http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny13_sparc.deb; http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny13_sparc.deb

MD5-kontrolsummer for de listede filer findes i den originale sikkerhedsbulletin.