________________________________________________________________________
Mandrake Linux Security Update Advisory
________________________________________________________________________
Package name: samba
Date: June 29th, 2001
Advisory ID: MDKSA-2001:062
Affected versions: 7.1, 7.2, 8.0, Corporate Server 1.0.1
________________________________________________________________________
Problem Description:
Michal Zalewski has found a vulnerability in all versions of Samba
prior to 2.0.10 where if a client sends an invalid netbios name Samba
could be tricked into appending it's log to files writable by root.
This can be very dangerous if combined with a symlink created by a
local user. Note that the log files must be specified as %m.log in
order for this to work, and Mandrake Linux ships Samba by default
using log.%m, thus it is not vulnerable "out of the box".
________________________________________________________________________
References:
http://us1.samba.org/samba/whatsnew/macroexploit.html
________________________________________________________________________
Please verify the update prior to upgrading to ensure the integrity of
the downloaded package. You can do this with the command:
rpm --checksig package.rpm
You can get the GPG public key of the Mandrake Linux Security Team at
http://www.linux-mandrake.com/en/security/RPM-GPG-KEYS
If you use MandrakeUpdate, the verification of md5 checksum and GPG
signature is performed automatically for you.
Linux-Mandrake 7.1:
56c2fd045833640c08f5380576f16410 7.1/RPMS/samba-2.0.10-1.3mdk.i586.rpm
c377973bfd8b699678e64d9a9b1674a3 7.1/RPMS/samba-client-2.0.10-1.3mdk.i586.rpm
030523ef3ac70fced03849c478c1ebfe 7.1/RPMS/samba-common-2.0.10-1.3mdk.i586.rpm
6a1e2d71492868704051133c7cea7f60 7.1/SRPMS/samba-2.0.10-1.3mdk.src.rpm
Linux-Mandrake 7.2:
991fdcad4c631cfa060bbc21374d2dd8 7.2/RPMS/samba-2.0.10-1.2mdk.i586.rpm
1da8547bb88864fd974f85efcd2643de 7.2/RPMS/samba-client-2.0.10-1.2mdk.i586.rpm
56420cded466e9a86b3159d2071fcb10 7.2/RPMS/samba-common-2.0.10-1.2mdk.i586.rpm
a5069f151064c25b4eafafb5e664c6e7 7.2/SRPMS/samba-2.0.10-1.2mdk.src.rpm
Mandrake Linux 8.0:
74c9279dfa603c53bb6d3849a6d8cb02 8.0/RPMS/samba-2.0.10-1.1mdk.i586.rpm
c2c233ff7fc7154605fde704667beee6 8.0/RPMS/samba-client-2.0.10-1.1mdk.i586.rpm
baaa778fe9e7c7bea536ebf827c02297 8.0/RPMS/samba-common-2.0.10-1.1mdk.i586.rpm
449f10822df5ccc49f839159e71a2019 8.0/SRPMS/samba-2.0.10-1.1mdk.src.rpm
Corporate Server 1.0.1:
5143308e3d3fea7e4d2905476819019c 1.0.1/RPMS/samba-2.0.10-1.3mdk.i586.rpm
0bf16d228879342e07bd721d3acd32a3 1.0.1/RPMS/samba-client-2.0.10-1.3mdk.i586.rpm
f5a02b96c6865561d4685ab12ea1bbb2 1.0.1/RPMS/samba-common-2.0.10-1.3mdk.i586.rpm
6a1e2d71492868704051133c7cea7f60 1.0.1/SRPMS/samba-2.0.10-1.3mdk.src.rpm
________________________________________________________________________
Bug IDs fixed (see https://qa.mandrakesoft.com for more information):
________________________________________________________________________
To upgrade automatically, use MandrakeUpdate.
If you want to upgrade manually, download the updated package from one
of our FTP server mirrors and upgrade with "rpm -Fvh *.rpm".
You can download the updates directly from one of the mirror sites
listed at:
http://www.linux-mandrake.com/en/ftp.php3.
Updated packages are available in the "updates/[ver]/RPMS/" directory.
For example, if you are looking for an updated RPM package for
Mandrake Linux 8.0, look for it in "updates/8.0/RPMS/". Updated source
RPMs are available as well, but you generally do not need to download
them.
Please be aware that sometimes it takes the mirrors a few hours to
update.
You can view other security advisories for Mandrake Linux at:
http://www.linux-mandrake.com/en/security/
If you want to report vulnerabilities, please contact
security@linux-mandrake.com
