DSA-2004-1 samba -- several vulnerabilities

Debian Security Advisory

DSA-2004-1 samba -- several vulnerabilities

Date Reported:

28 Feb 2010

Affected Packages:

samba

Vulnerable:

Yes

Security database references:

In Mitre's CVE dictionary: CVE-2009-3297, CVE-2010-0547.

More information:

Two local vulnerabilities have been discovered in samba, a SMB/CIFS file, print, and login server for Unix. The Common Vulnerabilities and Exposures project identifies the following problems:

• CVE-2009-3297

  Ronald Volgers discovered that a race condition in mount.cifs allows local users to mount remote filesystems over arbitrary mount points.

• CVE-2010-0547

  Jeff Layton discovered that missing input sanitising in mount.cifs allows denial of service by corrupting /etc/mtab.

For the stable distribution (lenny), these problems have been fixed in version 2:3.2.5-4lenny9.

For the unstable distribution (sid), these problems have been fixed in version 2:3.4.5~dfsg-2.

We recommend that you upgrade your samba packages.

Fixed in:

Debian GNU/Linux 5.0 (lenny)

Source:

http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny9.dsc

http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny9.diff.gz

Architecture-independent component:

http://security.debian.org/pool/updates/main/s/samba/samba-doc-pdf_3.2.5-4lenny9_all.deb

http://security.debian.org/pool/updates/main/s/samba/samba-doc_3.2.5-4lenny9_all.deb

Alpha:

http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny9_alpha.deb

http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny9_alpha.deb

http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny9_alpha.deb

http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny9_alpha.deb

http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny9_alpha.deb

http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny9_alpha.deb

http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny9_alpha.deb

http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny9_alpha.deb

http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny9_alpha.deb

http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny9_alpha.deb

http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny9_alpha.deb

http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny9_alpha.deb

AMD64:

http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny9_amd64.deb

http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny9_amd64.deb

http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny9_amd64.deb

http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny9_amd64.deb

http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny9_amd64.deb

http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny9_amd64.deb

http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny9_amd64.deb

http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny9_amd64.deb

http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny9_amd64.deb

http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny9_amd64.deb

http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny9_amd64.deb

http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny9_amd64.deb

ARM:

http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny9_arm.deb

http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny9_arm.deb

http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny9_arm.deb

http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny9_arm.deb

http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny9_arm.deb

http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny9_arm.deb

http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny9_arm.deb

http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny9_arm.deb

http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny9_arm.deb

http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny9_arm.deb

http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny9_arm.deb

http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny9_arm.deb

ARM EABI:

http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny9_armel.deb

http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny9_armel.deb

http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny9_armel.deb

http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny9_armel.deb

http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny9_armel.deb

http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny9_armel.deb

http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny9_armel.deb

http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny9_armel.deb

http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny9_armel.deb

http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny9_armel.deb

http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny9_armel.deb

http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny9_armel.deb

HP Precision:

http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny9_hppa.deb

http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny9_hppa.deb

http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny9_hppa.deb

http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny9_hppa.deb

http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny9_hppa.deb

http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny9_hppa.deb

http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny9_hppa.deb

http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny9_hppa.deb

http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny9_hppa.deb

http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny9_hppa.deb

http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny9_hppa.deb

http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny9_hppa.deb

Intel IA-32:

http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny9_i386.deb

http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny9_i386.deb

http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny9_i386.deb

http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny9_i386.deb

http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny9_i386.deb

http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny9_i386.deb

http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny9_i386.deb

http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny9_i386.deb

http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny9_i386.deb

http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny9_i386.deb

http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny9_i386.deb

http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny9_i386.deb

Intel IA-64:

http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny9_ia64.deb

http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny9_ia64.deb

http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny9_ia64.deb

http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny9_ia64.deb

http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny9_ia64.deb

http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny9_ia64.deb

http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny9_ia64.deb

http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny9_ia64.deb

http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny9_ia64.deb

http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny9_ia64.deb

http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny9_ia64.deb

http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny9_ia64.deb

Big-endian MIPS:

http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny9_mips.deb

http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny9_mips.deb

http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny9_mips.deb

http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny9_mips.deb

http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny9_mips.deb

http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny9_mips.deb

http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny9_mips.deb

http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny9_mips.deb

http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny9_mips.deb

http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny9_mips.deb

http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny9_mips.deb

http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny9_mips.deb

Little-endian MIPS:

http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny9_mipsel.deb

http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny9_mipsel.deb

http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny9_mipsel.deb

http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny9_mipsel.deb

http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny9_mipsel.deb

http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny9_mipsel.deb

http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny9_mipsel.deb

http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny9_mipsel.deb

http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny9_mipsel.deb

http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny9_mipsel.deb

http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny9_mipsel.deb

http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny9_mipsel.deb

PowerPC:

http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny9_powerpc.deb

http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny9_powerpc.deb

http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny9_powerpc.deb

http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny9_powerpc.deb

http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny9_powerpc.deb

http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny9_powerpc.deb

http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny9_powerpc.deb

http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny9_powerpc.deb

http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny9_powerpc.deb

http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny9_powerpc.deb

http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny9_powerpc.deb

http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny9_powerpc.deb

Sun Sparc:

http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny9_sparc.deb

http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny9_sparc.deb

http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny9_sparc.deb

http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny9_sparc.deb

http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny9_sparc.deb

http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny9_sparc.deb

http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny9_sparc.deb

http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny9_sparc.deb

http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny9_sparc.deb

http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny9_sparc.deb

http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny9_sparc.deb

http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny9_sparc.deb

MD5 checksums of the listed files are available in the original advisory.