From: Robert Buchholz (rbugentoo.org)
Date: Sat Mar 07 2009 - 10:26:15 CST

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200903-07
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: Normal
     Title: Samba: Data disclosure
      Date: March 07, 2009
      Bugs: #247620
        ID: 200903-07

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

A missing boundary check in Samba might lead to the disclosure of
memory contents.

Background
==========

Samba is a suite of SMB and CIFS client/server programs.

Affected packages
=================

    -------------------------------------------------------------------
     Package / Vulnerable / Unaffected
    -------------------------------------------------------------------
  1 net-fs/samba < 3.0.33 >= 3.0.33

Description
===========

Samba does not properly check memory boundaries when handling trans,
rans2, and nttrans requests.

Impact
======

A remote attacker could send specially crafted requests to a Samba
daemon, leading to the disclosure of arbitrary memory or to a Denial of
Service.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All Samba users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=net-fs/samba-3.0.33"

References
==========

  [ 1 ] CVE-2008-4314
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4314

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

  http://security.gentoo.org/glsa/glsa-200903-07.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
securitygentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2009 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (GNU/Linux)

iQIcBAABAgAGBQJJsqApAAoJECaaHo/OfoM5z8kQAL4JTQ8m4B7MUGoG06U8wFpQ
PxfuNkhYGrhudlAYzeP1GMpjaO8yB7OL3WnywOajehDmYvmYhcOJMwUTQ9ybc+Ih
lRs5kH8ftXZRX2GNhyJP97cvEr+7EhsuQa7kaBnCRiuIgGVA7R8ozad5TnuIdaD9
phOSX5Ami8Xxymn/3C7HJ0poSooucIfADP3rZdQb1HpITGVtNjdyCH/E3UcFtz3h
HuGRv4pkorFx74kxJvHjaru8pa88++17TFR2caf4nt4uT5wF5hTUvFBdEs/zTz94
kpNXV40T4s4TQoFXSKt73ILmzFRpED0bTpb3SsHfZiNemllqxnrSFZgfNzdFcNdO
d9GyfPQyVlf+NcPHBtdFHZEVGz3GIyafnqHwKnwAJVEujAaDw91yVUn+ycEb+OGO
CfXcq9oP5RvgylZoqodkhyeTlzslmif/HxkH2+EwQQoegKkpY8fBv2e9pyfDbcR5
wGBhMvNpcxGchtE3vkaqP4PQnSTjXi6kz1M3HszZ76l2ZDSrpfLOeiVMsMHDwTxs
7XSHam6/UifIXOqOhn3BQmb0VJ60uySJWgV+p+NsqpUhh4A7uYEZNbtdHRJwjFAs
HDsocp49EJ1wvoAIfFNYRzIa1faSCiXxgr8PTtoIKicFvigc2dGvXenfghCxAKMn
7nXBDLCYavRb09KLsrAc
=5ZWt
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]