Trustix Secure Linux Advisory: samba
Oct 04, 2004, 02:58 (0 Talkback[s])
Trustix Secure Linux Security Advisory #2004-0051
Package name: samba
Summary: access files outside of defined path
Affected versions: Trustix Secure Linux 1.5 Trustix Secure Linux
Samba provides an SMB server which can be used to provide network
services to SMB (sometimes called "Lan Manager") clients, including
various versions of MS Windows, OS/2, and other Linux machines.
Samba uses NetBIOS over TCP/IP (NetBT) protocols and does NOT need
NetBEUI (Microsoft Raw NetBIOS frame) protocol.Samba-2 features an
almost working NT Domain Control capability and includes the new
SWAT (Samba Web Administration Tool) that allows samba's smb.conf
file to be remotely managed using your favourite web browser.
A security vulnerability has been located in Samba 2.2.x <=
2.2.11 and Samba 3.0.x <= 3.0.5. A remote attacker may be able
to gain access to files which exist outside of the share's defined
path. Such files must still be readable by the account used for the
This has been assigned CAN-2004-0815 by the CVE.
We recommend that all systems with this package installed be
upgraded. Please note that if you do not need the functionality
provided by this package, you may want to remove it from your
All Trustix Secure Linux updates are available from
About Trustix Secure Linux:
Trustix Secure Linux is a small Linux distribution for servers.
With focus on security and stability, the system is painlessly kept
safe and up to date from day one using swup, the automated software
Users of the SWUP tool can enjoy having updates automatically
installed using 'swup --upgrade'.
Check out our mailing lists:
This advisory along with all Trustix packages are signed with the
TSL sign key.
This key is available from:
The advisory itself is available from the errata pages at
or directly at
MD5sums of the packages:
Trustix Security Team