Trustix Secure Linux Advisory: samba Oct 4, 2004, 02 :58 UTC (0 Talkback[s]) (2432 reads)
Trustix Secure Linux Security Advisory #2004-0051
Package name: samba
Summary: access files outside of defined path
Date: 2004-10-01
Affected versions: Trustix Secure Linux 1.5
Trustix Secure Linux 2.0
Package description:
Samba provides an SMB server which can be used to provide network
services to SMB (sometimes called "Lan Manager") clients, including
various versions of MS Windows, OS/2, and other Linux machines. Samba
uses NetBIOS over TCP/IP (NetBT) protocols and does NOT need NetBEUI
(Microsoft Raw NetBIOS frame) protocol.Samba-2 features an almost
working NT Domain Control capability and includes the new SWAT (Samba
Web Administration Tool) that allows samba's smb.conf file to be
remotely managed using your favourite web browser.
Problem description:
A security vulnerability has been located in Samba 2.2.x <= 2.2.11 and
Samba 3.0.x <= 3.0.5. A remote attacker may be able to gain access to
files which exist outside of the share's defined path. Such files must
still be readable by the account used for the connection.
This has been assigned CAN-2004-0815 by the CVE.
Action:
We recommend that all systems with this package installed be upgraded.
Please note that if you do not need the functionality provided by this
package, you may want to remove it from your system.
About Trustix Secure Linux:
Trustix Secure Linux is a small Linux distribution for servers. With focus
on security and stability, the system is painlessly kept safe and up to
date from day one using swup, the automated software updater.
Automatic updates:
Users of the SWUP tool can enjoy having updates automatically
installed using 'swup --upgrade'.
Verification:
This advisory along with all Trustix packages are signed with the
TSL sign key.
This key is available from:
<URI:http://www.trustix.org/TSL-SIGN-KEY>
