Discover Government News

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 201206-22
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Severity: High
    Title: Samba: Multiple vulnerabilities
     Date: June 24, 2012
     Bugs: #290633, #310105, #323785, #332063, #337295, #356917,
           #382263, #386375, #405551, #411487, #414319
       ID: 201206-22

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======
Multiple vulnerabilities have been found in Samba, the worst of which
may allow execution of arbitrary code with root privileges.

Background
=========
Samba is a suite of SMB and CIFS client/server programs.

Affected packages
================
    -------------------------------------------------------------------
     Package              /     Vulnerable     /            Unaffected
    -------------------------------------------------------------------
  1  net-fs/samba                 < 3.5.15                  >= 3.5.15

Description
==========
Multiple vulnerabilities have been discovered in Samba. Please review
the CVE identifiers referenced below for details.

Impact
=====
A remote attacker could possibly execute arbitrary code with root
privileges, cause a Denial of Service condition, take ownership of
shared files, or bypass file permissions. Furthermore, a local attacker
may be able to cause a Denial of Service condition or obtain sensitive
information in a Samba credentials file.

Workaround
=========
There is no known workaround at this time.

Resolution
=========
All Samba users should upgrade to the latest version:

  # emerge --sync
  # emerge --ask --oneshot --verbose ">=net-fs/samba-3.5.15"

References
=========
[  1 ] CVE-2009-2906
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-2906
[  2 ] CVE-2009-2948
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-2948
[  3 ] CVE-2010-0728
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-0728
[  4 ] CVE-2010-1635
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1635
[  5 ] CVE-2010-1642
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1642
[  6 ] CVE-2010-2063
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-2063
[  7 ] CVE-2010-3069
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3069
[  8 ] CVE-2011-0719
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0719
[  9 ] CVE-2011-1678
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1678
[ 10 ] CVE-2011-2724
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2724
[ 11 ] CVE-2012-0870
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0870
[ 12 ] CVE-2012-1182
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1182
[ 13 ] CVE-2012-2111
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2111

Availability
===========
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

 https://security.gentoo.org/glsa/201206-22

Concerns?
========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.

License
======
Copyright 2012 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5/

Gentoo: GLSA-201206-22: Samba: Multiple vulnerabilities

Multiple vulnerabilities have been found in Samba, the worst of which may allow execution of arbitrary code with root privileges.

Summary

Multiple vulnerabilities have been discovered in Samba. Please review the CVE identifiers referenced below for details.

Resolution

All Samba users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-fs/samba-3.5.15"

References

[ 1 ] CVE-2009-2906 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-2906 [ 2 ] CVE-2009-2948 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-2948 [ 3 ] CVE-2010-0728 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-0728 [ 4 ] CVE-2010-1635 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1635 [ 5 ] CVE-2010-1642 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1642 [ 6 ] CVE-2010-2063 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-2063 [ 7 ] CVE-2010-3069 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3069 [ 8 ] CVE-2011-0719 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0719 [ 9 ] CVE-2011-1678 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1678 [ 10 ] CVE-2011-2724 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2724 [ 11 ] CVE-2012-0870 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0870 [ 12 ] CVE-2012-1182 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1182 [ 13 ] CVE-2012-2111 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2111

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201206-22

Concerns

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

Severity
Severity: High
Title: Samba: Multiple vulnerabilities
Date: June 24, 2012
Bugs: #290633, #310105, #323785, #332063, #337295, #356917,
ID: 201206-22

Synopsis

Multiple vulnerabilities have been found in Samba, the worst of which may allow execution of arbitrary code with root privileges.

Background

Samba is a suite of SMB and CIFS client/server programs.

Affected Packages

------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-fs/samba < 3.5.15 >= 3.5.15

Impact

===== A remote attacker could possibly execute arbitrary code with root privileges, cause a Denial of Service condition, take ownership of shared files, or bypass file permissions. Furthermore, a local attacker may be able to cause a Denial of Service condition or obtain sensitive information in a Samba credentials file.

Workaround

There is no known workaround at this time.

Related News