mystified Posted July 25, 2004 Report Share Posted July 25, 2004 Mandrakesoft Security Advisories Package name samba Date July 22nd, 2004 Advisory ID MDKSA-2004:071 Affected versions 9.1, 9.2, 10.0, MNF8.2, CS2.1 Synopsis Updated samba packages fix vulnerability in SWAT, samba-server. Problem Description A vulnerability was discovered in SWAT, the Samba Web Administration Tool. The routine used to decode the base64 data during HTTP basic authentication is subject to a buffer overrun caused by an invalid base64 character. This same code is also used to internally decode the sambaMungedDial attribute value when using the ldapsam passdb backend, and to decode input given to the ntlm_auth tool. This vulnerability only exists in Samba versions 3.0.2 or later; the 3.0.5 release fixes the vulnerability. Systems using SWAT, the ldapsam passdb backend, and tose running winbindd and allowing third- party applications to issue authentication requests via ntlm_auth tool should upgrade immediately. (CAN-2004-0600) A buffer overrun has been located in the code used to support the 'mangling method = hash' smb.conf option. Please be aware that the default setting for this parameter is 'mangling method = hash2' and therefore not vulnerable. This bug is present in Samba 3.0.0 and later, as well as Samba 2.2.X (CAN-2004-0686) This update also fixes a bug where attempting to print in some cases would cause smbd to exit with a signal 11. Updated Packages Mandrakelinux 9.1 379a81194ac29a44ed5413f504b3f9c6 9.1/RPMS/nss_wins-2.2.7a-9.4.91mdk.i586.rpm 0d8bbc2ff31eb4759171066f87d586ec 9.1/RPMS/samba-client-2.2.7a-9.4.91mdk.i586.rpm b2699829ae743ca3a3d8c7af7f2287d0 9.1/RPMS/samba-common-2.2.7a-9.4.91mdk.i586.rpm edcb7e669f0b7fc25a23909add4eeb84 9.1/RPMS/samba-doc-2.2.7a-9.4.91mdk.i586.rpm dff7e002231035a7bb9c1d6cea97e9b5 9.1/RPMS/samba-server-2.2.7a-9.4.91mdk.i586.rpm 31ac013951ba5e625184a13532208666 9.1/RPMS/samba-swat-2.2.7a-9.4.91mdk.i586.rpm 2ba7a3214babff3bd3294ffd72d023a1 9.1/RPMS/samba-winbind-2.2.7a-9.4.91mdk.i586.rpm 127103f4f0b34572507ef4c94bb7356e 9.1/SRPMS/samba-2.2.7a-9.4.91mdk.src.rpm Mandrakelinux 9.1/PPC d7d1301be1efededc96cb6b1793a8fab ppc/9.1/RPMS/nss_wins-2.2.7a-9.4.91mdk.ppc.rpm 95b7a0ac457b26b72349242b626dc04f ppc/9.1/RPMS/samba-client-2.2.7a-9.4.91mdk.ppc.rpm 2261c5a2b3260ad8352feba778f5e826 ppc/9.1/RPMS/samba-common-2.2.7a-9.4.91mdk.ppc.rpm 3e7b43389cb32844862513726aee3ae2 ppc/9.1/RPMS/samba-doc-2.2.7a-9.4.91mdk.ppc.rpm 326b16a7121fdbe3d16aa33862de8d45 ppc/9.1/RPMS/samba-server-2.2.7a-9.4.91mdk.ppc.rpm 4bdb189ad68d5b9eeab6da7b581295ce ppc/9.1/RPMS/samba-swat-2.2.7a-9.4.91mdk.ppc.rpm 1abeacc0d08792e4e38a9ed22c9a0ebe ppc/9.1/RPMS/samba-winbind-2.2.7a-9.4.91mdk.ppc.rpm 127103f4f0b34572507ef4c94bb7356e ppc/9.1/SRPMS/samba-2.2.7a-9.4.91mdk.src.rpm Mandrakelinux 9.2 9bb1f0e25ed2389657501283bf52c054 9.2/RPMS/libsmbclient0-2.2.8a-13.2.92mdk.i586.rpm eec1734ea897176812921f443fe69d61 9.2/RPMS/libsmbclient0-devel-2.2.8a-13.2.92mdk.i586.rpm 1d179c626717703f6a49a9fd20894dcb 9.2/RPMS/libsmbclient0-static-devel-2.2.8a-13.2.92mdk.i586.rpm e12cfed3fe15749d43857b8aafe31b02 9.2/RPMS/nss_wins-2.2.8a-13.2.92mdk.i586.rpm f0cd976a453e8b23f0ef9c2c135fc5d7 9.2/RPMS/samba-client-2.2.8a-13.2.92mdk.i586.rpm 8475ca3829dc64ceea8f01abdcade21c 9.2/RPMS/samba-common-2.2.8a-13.2.92mdk.i586.rpm 9fc072548adc6bdd4d30dc9712a78c20 9.2/RPMS/samba-debug-2.2.8a-13.2.92mdk.i586.rpm cd67210e062a76a83249bf8b55741d1e 9.2/RPMS/samba-doc-2.2.8a-13.2.92mdk.i586.rpm 8f0abb6bc0a82843c5b448c86bb91165 9.2/RPMS/samba-server-2.2.8a-13.2.92mdk.i586.rpm 61c3cfb487802d83d3590f2a1e9d3e23 9.2/RPMS/samba-swat-2.2.8a-13.2.92mdk.i586.rpm f2f768247a5739b1bff40f2ec691b987 9.2/RPMS/samba-winbind-2.2.8a-13.2.92mdk.i586.rpm 783d6e588fdc85cfb3ba985b2d6abc9e 9.2/SRPMS/samba-2.2.8a-13.2.92mdk.src.rpm Mandrakelinux 9.2/AMD64 2352a24ec2b246314b184825cbe63852 amd64/9.2/RPMS/nss_wins-2.2.8a-13.2.92mdk.amd64.rpm 9d06697503f19e780963c5084d826f26 amd64/9.2/RPMS/samba-client-2.2.8a-13.2.92mdk.amd64.rpm 0c3b8f01c1aa411a72cffa24e0e3a321 amd64/9.2/RPMS/samba-common-2.2.8a-13.2.92mdk.amd64.rpm 056c03f2f44fca64ace44c791f8033d9 amd64/9.2/RPMS/samba-debug-2.2.8a-13.2.92mdk.amd64.rpm e241a63aa9b72f636fd40227bdb6ed84 amd64/9.2/RPMS/samba-doc-2.2.8a-13.2.92mdk.amd64.rpm 5c5cf771ce52300c3908a751ab2a0851 amd64/9.2/RPMS/samba-server-2.2.8a-13.2.92mdk.amd64.rpm fdc494fde0bf4a1562c9b78e2305792d amd64/9.2/RPMS/samba-swat-2.2.8a-13.2.92mdk.amd64.rpm 64abc0d71c0971febc1202bd47b57496 amd64/9.2/RPMS/samba-winbind-2.2.8a-13.2.92mdk.amd64.rpm 783d6e588fdc85cfb3ba985b2d6abc9e amd64/9.2/SRPMS/samba-2.2.8a-13.2.92mdk.src.rpm Mandrakelinux 10.0 3dc64ca8fe0f7b0aa51a2c84dc514592 10.0/RPMS/libsmbclient0-3.0.2a-3.2.100mdk.i586.rpm 779356b9c230eb85ce37f315232cdc95 10.0/RPMS/libsmbclient0-devel-3.0.2a-3.2.100mdk.i586.rpm bb4d71ecdefacd3dddddc3688a5eaad5 10.0/RPMS/libsmbclient0-static-devel-3.0.2a-3.2.100mdk.i586.rpm 74df83eb93096ffb23165dbbd28d2011 10.0/RPMS/nss_wins-3.0.2a-3.2.100mdk.i586.rpm 02c7352e5e845c2a3e38d7e321bcbd4b 10.0/RPMS/samba-client-3.0.2a-3.2.100mdk.i586.rpm 28e209b5899bd01b8d39f4dec3677424 10.0/RPMS/samba-common-3.0.2a-3.2.100mdk.i586.rpm 6c5bcd82b4544fe8ddb1e0d70bacfcec 10.0/RPMS/samba-doc-3.0.2a-3.2.100mdk.i586.rpm 43bf0b8c550df90bbe7aee619c5f27b6 10.0/RPMS/samba-passdb-mysql-3.0.2a-3.2.100mdk.i586.rpm b34d77cf576bc3c6a39e50ccb04fc1ee 10.0/RPMS/samba-passdb-xml-3.0.2a-3.2.100mdk.i586.rpm 1a60acc6cc523537987c789daaa17b99 10.0/RPMS/samba-server-3.0.2a-3.2.100mdk.i586.rpm d5f09f07939dadda6d39ce619d918dce 10.0/RPMS/samba-swat-3.0.2a-3.2.100mdk.i586.rpm 3f4abab7d5fe16d8db612b07c1c1165d 10.0/RPMS/samba-winbind-3.0.2a-3.2.100mdk.i586.rpm 954256f8fb2dcbff886b1d6a4535bc03 10.0/SRPMS/samba-3.0.2a-3.2.100mdk.src.rpm Mandrakelinux 10.0/AMD64 cb4d44e5e85e240a61d601d94b423e82 amd64/10.0/RPMS/nss_wins-3.0.2a-3.2.100mdk.amd64.rpm 99906563140b9dee6e919ab4ca0e61fe amd64/10.0/RPMS/samba-client-3.0.2a-3.2.100mdk.amd64.rpm cf0c4f39aa078547923032562c170884 amd64/10.0/RPMS/samba-common-3.0.2a-3.2.100mdk.amd64.rpm a3a2cfd0fe222cf59408720a97eae315 amd64/10.0/RPMS/samba-doc-3.0.2a-3.2.100mdk.amd64.rpm 3adb7cbc3f031e1985fc356fd6cd28d6 amd64/10.0/RPMS/samba-passdb-mysql-3.0.2a-3.2.100mdk.amd64.rpm d3626d21a8dfd121e6126f2c20c68b12 amd64/10.0/RPMS/samba-passdb-xml-3.0.2a-3.2.100mdk.amd64.rpm 7bce8bf6a2ce61b6d067d29e50cb5959 amd64/10.0/RPMS/samba-server-3.0.2a-3.2.100mdk.amd64.rpm 820dbe19028f73bebf2c1615aa41506c amd64/10.0/RPMS/samba-swat-3.0.2a-3.2.100mdk.amd64.rpm 527d993e2e001ab8585d01f6abd5fed1 amd64/10.0/RPMS/samba-winbind-3.0.2a-3.2.100mdk.amd64.rpm 954256f8fb2dcbff886b1d6a4535bc03 amd64/10.0/SRPMS/samba-3.0.2a-3.2.100mdk.src.rpm Multi Network Firewall 8.2 30aff3d72c2c21f9a4adf930be4a4741 mnf8.2/RPMS/samba-client-2.2.7a-9.4.M82mdk.i586.rpm 2ef26ca649d580ef375a7f0f8680b764 mnf8.2/RPMS/samba-common-2.2.7a-9.4.M82mdk.i586.rpm b7ea85f4455756d7e7d1c9afe19977b5 mnf8.2/SRPMS/samba-2.2.7a-9.4.M82mdk.src.rpm Corporate Server 2.1 2e17c334f02b4247f1bf2f6e4b5837e3 corporate/2.1/RPMS/nss_wins-2.2.7a-10.2.C21mdk.i586.rpm a3c3a6dce249f920c2ebef2e42d22efb corporate/2.1/RPMS/samba-client-2.2.7a-10.2.C21mdk.i586.rpm 7e66a36c672abc713c3b78afa62cec4f corporate/2.1/RPMS/samba-common-2.2.7a-10.2.C21mdk.i586.rpm bf9cb0590bb03749f67b969a8ce47d5b corporate/2.1/RPMS/samba-doc-2.2.7a-10.2.C21mdk.i586.rpm ba68c6016296c95ba5e60b0caada3d7b corporate/2.1/RPMS/samba-server-2.2.7a-10.2.C21mdk.i586.rpm 33d9a4c1ad830727fcc8c0c74c15b133 corporate/2.1/RPMS/samba-swat-2.2.7a-10.2.C21mdk.i586.rpm 045eb0d5f4564a344dd1ec52affba34e corporate/2.1/RPMS/samba-winbind-2.2.7a-10.2.C21mdk.i586.rpm f24a2423c032564d94bc4fb7166aab93 corporate/2.1/SRPMS/samba-2.2.7a-10.2.C21mdk.src.rpm Corporate Server 2.1/X86_64 64cf3d1928c082f359ee77114a013c09 x86_64/corporate/2.1/RPMS/nss_wins-2.2.7a-10.2.C21mdk.x86_64.rpm cc53b273802b83a7bde754964f6c1a6a x86_64/corporate/2.1/RPMS/samba-client-2.2.7a-10.2.C21mdk.x86_64.rpm 5cb1a2021b4b122c1a43372afce7f4a7 x86_64/corporate/2.1/RPMS/samba-common-2.2.7a-10.2.C21mdk.x86_64.rpm 664628aa6e499379662cd6dda3eb3194 x86_64/corporate/2.1/RPMS/samba-doc-2.2.7a-10.2.C21mdk.x86_64.rpm 55a1275bee7a01f3a01629bfafade340 x86_64/corporate/2.1/RPMS/samba-server-2.2.7a-10.2.C21mdk.x86_64.rpm be77b207466e796e3f0625b3e6b2137f x86_64/corporate/2.1/RPMS/samba-swat-2.2.7a-10.2.C21mdk.x86_64.rpm fe9fad601a5c9086d49ec7c7ff5178db x86_64/corporate/2.1/RPMS/samba-winbind-2.2.7a-10.2.C21mdk.x86_64.rpm f24a2423c032564d94bc4fb7166aab93 x86_64/corporate/2.1/SRPMS/samba-2.2.7a-10.2.C21mdk.src.rpm References http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0686 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0600 Upgrade To upgrade automatically, use MandrakeUpdate. Verification Please verify the update prior to upgrading to ensure the integrity of the downloaded package. You can do this with the command: rpm --checksig package.rpm You can get the GPG public key of the Mandrakelinux Security Team to verify the GPG signature of each RPM. If you use MandrakeUpdate, the verification of md5 checksum and GPG signature is performed automatically for you. Link to comment Share on other sites More sharing options...
Recommended Posts