- ------------------------------------------------------------------------
Debian Security Advisory DSA-1823-1                  security@debian.org
http://www.debian.org/security/                          Thijs Kinkhorst
June 25, 2009                         http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package        : samba
Vulnerability  : several
Problem type   : local (remote)
Debian-specific: no
CVE Id(s)      : CVE-2009-1886 CVE-2009-1888

Several vulnerabilities have been discovered in Samba, a SMB/CIFS file,
print, and login server. The Common Vulnerabilities and Exposures project
identifies the following problems:

CVE-2009-1886

    The smbclient utility contains a formatstring vulnerability where
    commands dealing with file names treat user input as format strings
    to asprintf.

CVE-2009-1888

    In  the smbd daemon, if a user is trying to modify an access control
    list (ACL) and is denied permission, this deny may be overridden if
    the parameter "dos filemode" is set to "yes" in the smb.conf and the
    user already has write access to the file.

The old stable distribution (etch) is not affected by these problems.

For the stable distribution (lenny), these problems have been fixed in
version 3.2.5-4lenny6.

The unstable distribution (sid), which is only affected by CVE-2009-1888,
will be fixed soon.

We recommend that you upgrade your samba package.

Upgrade instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 5.0 alias lenny
- --------------------------------

Source archives:

      Size/MD5 checksum: 50276407 0f7539e09803ae60a2912e70adf1c747
      Size/MD5 checksum:     2129 db28861cc892f2d668f1bfab3cb6c3c7
      Size/MD5 checksum:   230084 d852787acdea471c6360411043ca5e2d

Architecture independent packages:

      Size/MD5 checksum:  7952816 bd2754bfb3b0ddcedab4981f12e7dc48
      Size/MD5 checksum:  6252144 db04f0a55b0bbb6955a3ba832ca5857a

alpha architecture (DEC Alpha)

      Size/MD5 checksum:   637434 f7ad1cd7fbea3fa8e96dca5d5d0bea89
      Size/MD5 checksum:  5729860 b1539b6bbd17875e807eaf43ab08afa7
      Size/MD5 checksum:  3273732 7aa5ee1eb1f248e070783226aedfeafb
      Size/MD5 checksum:  1945070 69739418fd22e38b89e092d0ce675b10
      Size/MD5 checksum:  3735958 370be95e60a9dab92622b4c20ddac73e
      Size/MD5 checksum:  1461494 fe735e7d26cbcb180ab7ec294f687542
      Size/MD5 checksum:    81336 f196a258751e9e460968980f6c0f0adf
      Size/MD5 checksum:  4829906 c80836141dc2957cbb89d3e03ebb6eb3
      Size/MD5 checksum:  6952908 bb8318576e63be9ba0deb142c40f4931
      Size/MD5 checksum:  2572478 8288895fedee4af735bd2cc246e5e14e
      Size/MD5 checksum:  1078250 7078de90bd6987f40902218b5f21ebad
      Size/MD5 checksum:  1333128 6d86a0a6efd05a74358982a927487400

amd64 architecture (AMD x86_64 (AMD64))

      Size/MD5 checksum:  1082526 1216bc7530570a8952cec672bbf4d545
      Size/MD5 checksum:  7004108 88e0b32dbb34a77838e7c4d77bfa3344
      Size/MD5 checksum:  5647540 4a89061ec0beb98542451f0a38a0ee36
      Size/MD5 checksum:  4775304 a62bff040c466df7902475a6051b0ce0
      Size/MD5 checksum:  1358734 8a0dab5075cc8968fc28a94c460a1489
      Size/MD5 checksum:   627654 c90bc8775c907462f1b2be314cce54b0
      Size/MD5 checksum:    80314 7a879cdabf79883eccc66955092b9161
      Size/MD5 checksum:  1995414 a58fda29c17854fe339cdb6292ea305a
      Size/MD5 checksum:  1493214 041b86c0219270b975732ae041ee2615
      Size/MD5 checksum:  3277188 623bbf4f69d3353b934663908543ddaf
      Size/MD5 checksum:  3727478 4cd1814846a7aafd990d40bfca784955
      Size/MD5 checksum:  1955832 4a459387cf6d6879f5e647dc82a0317d

arm architecture (ARM)

      Size/MD5 checksum:  3352906 acae97b45fafe13e7b1059882e502ca4
      Size/MD5 checksum:  2887166 105bbfb44f14262c75c638baceeed6fe
      Size/MD5 checksum:  2399052 13aa106c12a81977ad5d062f52cd0f49
      Size/MD5 checksum:  4267018 73ffa68c1026185adf065a8db79a14dc
      Size/MD5 checksum:  5040460 241dd399cf488bb7097b66ecc7a9e395
      Size/MD5 checksum:  6171700 3b886b7f60404a20cd28fd93ad5ab3b6
      Size/MD5 checksum:  1203444 83e4e2b11db667d4e4f443daa52b2b77
      Size/MD5 checksum:   972128 0baed4e1a5df9d915f3656896ec8b9c4
      Size/MD5 checksum:    78644 b69aaa0d95230f3aa30fd034e38d3907
      Size/MD5 checksum:  1818740 72401de5991370e8a5aff78b83a1fc65
      Size/MD5 checksum:   559734 91d721daecd493f972207338af1d251b
      Size/MD5 checksum:  1313810 c1c08281af6605849fe28bf03fbeffc3

armel architecture (ARM EABI)

      Size/MD5 checksum:   978268 7117db14438cc4ba490984317fab3397
      Size/MD5 checksum:  2908492 90209b451a115ec8f6ce123aea0eaa66
      Size/MD5 checksum:  1823266 23ce4189eae27568ef437ec2f2affa18
      Size/MD5 checksum:  1210360 f6090e3af5191dfc5fec1f30e451a320
      Size/MD5 checksum:  5071154 a38e236cf9fee43ee208c0167e41db74
      Size/MD5 checksum:  1323680 60fcce70c75a1be8786eae5df1ecb4c1
      Size/MD5 checksum:   564486 b88e04aff2c6f6563e9bb303bbed57ac
      Size/MD5 checksum:    78956 2fb7f87a119bc4db8178db5a2f65e553
      Size/MD5 checksum:  6214872 e05a93a5fc5c67ddf65b0614c0ac4aa7
      Size/MD5 checksum:  3365930 1a2d47d98bec7ef72813992464dd8b7e
      Size/MD5 checksum:  2426646 9c5175363f4e8e18d3e6715ac36f1196
      Size/MD5 checksum:  4291572 3672ec603439ef7dbc4f8845e5cbad7d

hppa architecture (HP PA RISC)

      Size/MD5 checksum:  3602390 39a39d96bd2e8c68ea411168b93218fd
      Size/MD5 checksum:  2227840 97458a996ea3833e57e7a48978daacb9
      Size/MD5 checksum:  3173830 976fffed1bab8e9712611cb02313f5ac
      Size/MD5 checksum:  2064376 b02d8426ec41ddaa87fd0c982a40e1c5
      Size/MD5 checksum:  5500050 d7defc9587d06e9696224c7d7ee2969b
      Size/MD5 checksum:  1375136 e4a732ddc8a442a1748462be5f1fdb43
      Size/MD5 checksum:  1414358 0eef6d9b3ce5c3f4a098b86706ebce6d
      Size/MD5 checksum:  1050218 d680aa45d2d27ca4179d6651d0951aff
      Size/MD5 checksum:    80874 c44e6172e7533c18e71965ee5ef50fbb
      Size/MD5 checksum:  4655842 561eb6d3b2c85db85e2b60134a248943
      Size/MD5 checksum:  6688408 cd12bac4cd6c7b935fe65635a87345c0
      Size/MD5 checksum:   631454 7fe9ddcb0fb579dd37496b56073f4da4

i386 architecture (Intel ia32)

      Size/MD5 checksum:    79064 f4eb68a6bae3c07b1e51dc1c169a1ddc
      Size/MD5 checksum:  1824414 c42d523c91d6f424ce8a4d9b00c78bff
      Size/MD5 checksum:  5068282 b38ef7a6a46c63865d3149c0f037c134
      Size/MD5 checksum:  1349626 b64a569735a3444fb2136ed18ff9d5f9
      Size/MD5 checksum:  1199736 c51d918bd556d94de66a87e28f8cb9c7
      Size/MD5 checksum:   985082 31cc4352813dd27347ea611e1fcaf1cd
      Size/MD5 checksum:  6303132 c84c05939ad1b124e38f70fc5cc2fe83
      Size/MD5 checksum:  2080460 c61c20b2b3bf2540af9178d92083f92c
      Size/MD5 checksum:  4295736 88abf2d2fceecd8b6c2d8b3d1119cca5
      Size/MD5 checksum:  2930722 853fe0b445dadab6b1c00024848994b4
      Size/MD5 checksum:   561782 a27c8c29642a9692de6a1110ec541bba
      Size/MD5 checksum:  3408460 466cf72637d9c7d63407059b57cbb3e8

ia64 architecture (Intel ia64)

      Size/MD5 checksum:  3915294 b2750f80bf3adb8c3e118c8419cd986f
      Size/MD5 checksum:  1939440 87d66bcd13876ba7e517cd3580375485
      Size/MD5 checksum:  5832234 94f396c322d240fbab312d1474141c1f
      Size/MD5 checksum:  1561034 ee26e65a181c215fc14cf4b717c605a1
      Size/MD5 checksum:  1279826 a67fb922b89257c9ec099bd44f64a73a
      Size/MD5 checksum:  1723578 5aa2615a29d3863bf50149fb78912d80
      Size/MD5 checksum:   751814 57d28a8d9da46a0418ec513988ed6153
      Size/MD5 checksum:  2400748 fd80d5f06efbeb6221840f471eb3b254
      Size/MD5 checksum:  6932868 618d5331c59b2caa85fbcd932dd265d3
      Size/MD5 checksum:  4386290 84c2020e19c46e66ae1c213e825fbc62
      Size/MD5 checksum:    83850 5c513363955f940ca419dc818adb9e1b
      Size/MD5 checksum:  8294478 6b864bba8a9b1c996a826c93826eddee

mips architecture (MIPS (Big Endian))

      Size/MD5 checksum:  4999750 7067e693b632ec74af7b2603407dd38f
      Size/MD5 checksum:   572708 e2de7af02f554e0bc3bc0cca07b0f227
      Size/MD5 checksum:  4200272 bf7472667f9d2a195b7704e73a9cb019
      Size/MD5 checksum:  1206384 57c1663633996c07e2c035a916bbfb1f
      Size/MD5 checksum:  1092748 e7f6a6afeeef72e6a04f4162d07b290d
      Size/MD5 checksum:  2811632 f7735e6cda984e3f412968c419c4d28a
      Size/MD5 checksum:  2501378 3522c8675a139cd3562568256593e2d0
      Size/MD5 checksum:  2183476 a20700da67e004131311b065c3b0c9c1
      Size/MD5 checksum:  3243414 b2a116edba87ef7f3e76caae15d6e3ff
      Size/MD5 checksum:    78842 ca0d24606402e70961c1e74d2f043927
      Size/MD5 checksum:  5840314 3de458de59dc90b3d63e4b1c03344e57
      Size/MD5 checksum:   941914 4c86900ce4c34237841dcd2fb1c1bffe

mipsel architecture (MIPS (Little Endian))

      Size/MD5 checksum:  4965958 cc781a7ba7142f5f6edab2b5a60beafd
      Size/MD5 checksum:  2792800 c52519e54bb5304185263509c25fd1dc
      Size/MD5 checksum:   569092 5a13a73defa73f53367691ecc21d9a19
      Size/MD5 checksum:  2128130 bd40dcf324632aea1640a497d7791abe
      Size/MD5 checksum:   936724 652c3020635bb29e3fba5230a5334ab3
      Size/MD5 checksum:    79068 2c14bb1116277946c6dc162c7bc4c005
      Size/MD5 checksum:  1196220 baad083cdb6029c9e7bc2053d6f61e28
      Size/MD5 checksum:  3219014 4b571498f8562ca803ee92eb9758f4d1
      Size/MD5 checksum:  5800592 6927d1c61acd67148a7f65661b4e42ee
      Size/MD5 checksum:  4177500 8cf03a00d7bf98f70c11fa8e0abc1aaf
      Size/MD5 checksum:  2388184 a6eb03d33b8828e77ae6c4efd92f0488
      Size/MD5 checksum:  1081400 1bc9f7786ea878df1238805e7b3a08fa

powerpc architecture (PowerPC)

      Size/MD5 checksum:  6296456 01154b1ef03cb2c7d9871bd3b1a7644d
      Size/MD5 checksum:   594818 33050da2cda2a6f2f423c52c80928579
      Size/MD5 checksum:  3425052 8cc0692d7b4272c4578bcd29bc2dd42d
      Size/MD5 checksum:  1714000 7e2b872f0fc56c0280a31b39ecc0d4c6
      Size/MD5 checksum:  5188306 b4e43737be940264bd9da2af1cfe8bff
      Size/MD5 checksum:    80090 21240d752e41670479135bdfc6061362
      Size/MD5 checksum:  1239184 86cafa0e1e2fb7316aacdf02a6b8ee8e
      Size/MD5 checksum:  1334068 2ae4e72bf56ac4f8c2730c332c817c7a
      Size/MD5 checksum:  4405112 0dcce9c247e03681ae6cb64fa6270c9b
      Size/MD5 checksum:  2076430 4b90fe923cd8c79513ae7d001642664b
      Size/MD5 checksum:   988758 d864bff58df49bba310036fd9506ed26
      Size/MD5 checksum:  2988664 54c7135c12b5b80f3873c51727f6da8f

s390 architecture (IBM S/390)

      Size/MD5 checksum:  5647344 e291ca0866c5181b701c4c7dd7ee75cb
      Size/MD5 checksum:   641704 890092f875c0b30025e815b1496d4777
      Size/MD5 checksum:  3204434 300a6e447ae3ae6d82d4e19b5f9b268e
      Size/MD5 checksum:  3650290 d438fdbbdbb6446906e9f5663fb49c1f
      Size/MD5 checksum:  4739978 0b1a01bb72e1364d9e9eeb8a3d5c85a3
      Size/MD5 checksum:  1056694 8760ed74e244955a58e85b7a6fd88edf
      Size/MD5 checksum:  1389316 c1509f8dd9d3b89c63f549858b15604a
      Size/MD5 checksum:  1935532 477a901113f0388ad6a98434ccaff380
      Size/MD5 checksum:  2061196 12aa67adfc4e254b1d0af53e118d837f
      Size/MD5 checksum:  6706196 bae3dda384bee7f5ea142f21b5cdaf92
      Size/MD5 checksum:  1257752 fb3bcc6af4535d5d0a407d6c5f55ac87
      Size/MD5 checksum:    80682 4886e29302a9316f98d3384cb5c86e14

sparc architecture (Sun SPARC/UltraSPARC)

      Size/MD5 checksum:  4321934 ef0d8092541c2ad4a6895ac4c9323595
      Size/MD5 checksum:  1303706 71aa2e2e6e539c201374f2480da7bb5a
      Size/MD5 checksum:  3372056 338a6fb9d5232d0b6b287dc20e690fab
      Size/MD5 checksum:  2020694 c593de477925258618f9fcbfc4fb9ff6
      Size/MD5 checksum:    79010 630e7c83bb7cd45e14203c4e810abfdf
      Size/MD5 checksum:  6172018 86ecef108fe87a1cb05c76fb65cbbbde
      Size/MD5 checksum:   581518 fb6ef646205ae10fb3609713e23a9148
      Size/MD5 checksum:  1202020 c8745b704a888246ede0a738b0a77366
      Size/MD5 checksum:  5116600 88a59d0b509b8ede6712d1a08521bb11
      Size/MD5 checksum:  2924928 bb7330657382c7501985c52ca0528ec5
      Size/MD5 checksum:   975276 cd2f16cf95b5cde6e2364c917cec645e
      Size/MD5 checksum:  1995988 b6d92bd1207876bf19793a4fbde7f173


  These files will probably be moved into the stable distribution on
  its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp:  dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show ' and http://packages.debian.org/