-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
______________________________________________________________________________
SUSE Security Announcement
Package: samba
Announcement ID: SUSE-SA:2007:065
Date: Wed, 05 Dec 2007 16:00:00 +0000
Affected Products: SUSE LINUX 10.0
SUSE LINUX 10.1
openSUSE 10.2
openSUSE 10.3
UnitedLinux 1.0
SuSE Linux Enterprise Server 8
SuSE Linux Openexchange Server 4
SuSE Linux Desktop 1.0
SuSE Linux Standard Server 8
SuSE Linux School Server
SUSE LINUX Retail Solution 8
SUSE SLES 9
Novell Linux Desktop 9
Open Enterprise Server
Novell Linux POS 9
SUSE Linux Enterprise Desktop 10 SP1
SLE SDK 10 SP1
SUSE Linux Enterprise Server 10 SP1
Vulnerability Type: remote code execution
Severity (1-10): 7
SUSE Default Package: no
Cross-References: CVE-2007-5398
CVE-2007-4572
Content of This Advisory:
1) Security Vulnerability Resolved:
fixed two buffer overflows
Problem Description
2) Solution or Work-Around
3) Special Instructions and Notes
4) Package Location and Checksums
5) Pending Vulnerabilities, Solutions, and Work-Arounds:
none
6) Authenticity Verification and Additional Information
______________________________________________________________________________
1) Problem Description and Brief Discussion
The samba-suite is an open-source implementation of the SMB protocol.
CVE-2007-5398:
Secunia Research has reported a bug in function reply_netbios_packet()
that allowed remote attackers to execute arbitrary code
by sending specially crafted WINS "Name Registration" requests followed
by a WINS "Name Query" request packet.
The exploitable code in samba can only be reached if the option "wins
support" was enabled.
CVE-2007-4572:
Another bug reported by Secunia Research affected the processing of GETDC
mailslot request in nmbd. This error can also be exploited remotely to
execute arbitrary code, but only if samba was configured as Primary or
Backup Domain Controller.
2) Solution or Work-Around
Please install the provided samba update packages.
3) Special Instructions and Notes
Please restart the samba daemons.
4) Package Location and Checksums
The preferred method for installing security updates is to use the YaST
Online Update (YOU) tool. YOU detects which updates are required and
automatically performs the necessary steps to verify and install them.
Alternatively, download the update packages for your distribution manually
and verify their integrity by the methods listed in Section 6 of this
announcement. Then install the packages using the command
rpm -Fhv
to apply the update, replacing with the filename of the
downloaded RPM package.
x86 Platform:
openSUSE 10.3:
14fe2bb97903a1184420edb1c8cd91ab
5076f9efd5b4b375abc56a0c805fb975
270f3d20ac547a4f02eb7e1cbb2ee8b1
729cadd5041edc7f03f21c784c6b85bb
a2566202716e9d8cd7bcd6928ded4ce0
bc36927bb01e46e9b2deb1b2d1fcf745
59a261a3b0c25bf08f2700436a70f3e3
548acc17d4a80b83ac55c3b627955bf8
94b668592e808f28293ea1ea3a62d3f0
30fe5f450ce9516bcbc5852ceea60f02
077b7741322895a40740954043db6929
1afd7fa4037a05a692e819c6f2c07363
8d381a7574f565321f0643f2c282ea5e
f402850bba03c85e96b740b2f0ac1454
7644257c79de02f67eb7bfe54ac57f33
openSUSE 10.2:
8ccde4dd789f893ba1362da7e819a840
966284924eddb1d99ee5fe8a469fe915
139822c22fea9ae1f0141f799bf091ea
fe77521e9ee88bf2604eff585d061d05
33a11dc959526883613d9923bc4e13fc
1f865efafe1fab44172340195e66c3af
6b1bbca71a0643ccec19929cb52031bb
89e9f6e9c0993470e70f411ea3801f4f
d99011b9f749140cf80b1fabfb6a54a0
ca93991e649e1e2272715779f9716f52
671bf08a3f7b62e93da1ced4bef31742
a0966a86569a13402dd4438b62a0bf10
17a7134d8cef65a361566ea4304fefe4
SUSE LINUX 10.1:
f13dd16a6abe3d5c960f75982fe1eedf
3ab30876f7cf45ae3bef0fd83a3bfd2d
bc467864f082a15ac315fb1254b6df3a
2feb2176c4c56259cb69697a59294fda
0336590ca50764840b63926ef586ff80
038564f0986003f5759335e856d76f0b
8b3b1cf5ffe433d03effc8b93cf4adb1
7973ecd4259e5711e517a11706de59c5
38e3f5e6d9fe21e28e7f3b7e231bc973
124e5ad410dbe369332f776fa9899b18
0fdb009bb860cd97403630323e110f14
d2c9133fa8be2dfc1f79c0476c64be12
SUSE LINUX 10.0:
2921e713f4da35351148c4b937728981
a15703aeb6c91c5a386c352bb6a52496
5fedfe5cfa80a9cb9eb50114a6668d7d
9b39b90a4b854480dc65ac09d50b8f5a
e6d2644adea97106855950eaf6a3aa51
2fda9ea9ef15e217ab7274fa70459d92
c4f5426c218a994630a76f0d32cd9e3e
04d1b78cf732a8e38daadb5f521c0fbc
343b2aaa31d327a4355524cc59cf2c12
9d9cbe74afe66c2d94da56f51078c674
f119e26c0aa57edc31bed023973df92e
Platform Independent:
openSUSE 10.3:
6846ff9d376e6a33fd0ee0cff6dd86a1
openSUSE 10.2:
2dfce780a4211c537ae21a92d307a3b5
SUSE LINUX 10.1:
9c13398cd8be995cb7823bc749e419f7
Power PC Platform:
openSUSE 10.3:
cd4db7e449aa2e16faa79ea555569535
681fde00928cce85a082b92136417e7e
ee20f10891611560bee4a4efc4dce597
f396f340c24effdc9c769a05dab6ea1a
737df32d26bb1e19633b4b15e235e402
dd81a1c74872d03b8774e7728c9fe7ad
e8811a907ad371207209a34c843de11c
4d702a5cde9822ad5aca32fa408f70c1
c17d1ce838b1a5edc27151967c9c172d
91938d2a1a08a4e5baabf8b11eafc204
a1e9015a9b11099af46988ac6d36f7bc
281d6999da5cf849bb2f0d4a000ef526
5b18a5c5f8acf53d3e0704975b3f1daf
0ad0bd954f75ad44b018e427c1d03a16
fb83f45f7744ab4e8ef11d6c3e09a419
openSUSE 10.2:
04f63548d575cd8d7982962069d14915
5a44e13be59b31c3b7aaebeea1746c34
f5200b9cb55bc6767ea8ba44fec0a7ee
fa0fa3bc47fa629d888684fa227ff71a
c74f98dd6a181f3c7fe5c8bc2f7dec79
fc45c4a50432cde21c08440c4b45b22a
20fc3dfeaabb2b52d76e8d993ded89db
8257c799f755c1e5a4384c9e9c20d235
b799e145e3aedbeb5a6e75775861cbe4
1ea46758cf6ecb184fa8b1907dfdca74
3bd22f16534a31e9104a3c088d8aee80
1f78074b3a7b77f432388c05ddc3d14e
c17e608b1b9482d27edb234043e17d3d
SUSE LINUX 10.1:
7bc15580657e490d7fc463b409153c41
0aac5cf5cf83b1f75faa0de6a42f3d9c
49c54ca562b28e2e004bdf9f63f4200a
8501c3db58735d980adcdcc20f04c254
a9be46f3a9255fc4064bba1cd56fc2c1
815654df8fcfc6d6c36b489d977dcb43
abbb54105d90fb535d30cbc186e5660d
1f53014fcd14b7f16aa3cabb27d36dce
0074d970fec25817a99ccc8d7c80a124
29eb937b609e6f5e421f3cc90cc2bc19
fa80b835a0a26032df5752de81cc0299
fb6850e265d104b11f491eb57d061cd1
SUSE LINUX 10.0:
d8d7f212df361caa4865cee733fc9dec
caf36453cd29a27ff1402d2a0b8e2273
e7fb337f1360d8fc8afc6d552e734062
8eb2585161daff25ade8584897a4a9dc
e056c2e9516d6835783734a854f33f5b
a3e7d280318dc4284813bcc61f619d30
f2d60bda261a466558af3bc2aa9ac96e
1ccc2adbbbf0adab5972f132f384a243
239c68b7f241056dd69470e2cedcd44d
9074a6835b98944586b3108a4e277e3b
0edd15eccfa3382011945c379e951285
x86-64 Platform:
openSUSE 10.3:
0250de54adf2e2e49e9808052bf3fde1
34cdf9014e403e9f27dd5ed703d1fef4
a8fae2da33edad69e10328ac63484f0a
781c82df3171f48f85c3b3d0cc682dee
aec9cdee7c7092547576ab63efa54bba
6638bb3dc260636d8e7feedd215d5ae8
5bd7d582930c1ef779c0963358f1a2c3
ce2142b13a69d61ffdf73edac3f27211
59938a005792947cb71489d0670e9c69
fa1e1004d27fb371955e6418d2552a05
cb6fdbf7f83c7eab24b8d40cd5c19d31
13feb6dc1cc9fbedbc08cd874234c8a0
8da1a6ba404580186c19cc5ab8f7319a
49bb1f30af2224b30e5b0e427d046ed5
10f587e53369ea87b972fbd24df00015
f9072b255947e482455544e64cb6eeda
798c6004e42cc5deb79ac3fc159e68fd
818b94de1ea8c8cc7bb1bef7225dff10
fcdde97dd2332dbbcac5bfe437ddf605
openSUSE 10.2:
75c9dd1cbd9a4aaae9fa0b5e066ebc6c
33225047fd763d6d6a21185e2cdb9787
3456307ba1bf5960fc31cfb5e78ec73b
e09bbc56323bc22a094ee4449be363ef
f845b7165577251649e14bc7ca760518
895e9e3837ea5da9ef4c74eb155d50e5
ead13aa6956de22826a391b575f7e5ad
6bb77019fc3ca84b3004d69a4210c219
d41110c83caf90883d68253a03f56cb9
a27ca2d2a37691403d77e98fabdf6eae
27b16c5a86d629126c092fa16f2b4dbc
ce42563a00b1bcc96e8081c94d907125
bc63ec7af7550f0a32e40eab5da3bafc
8f54b8d4ba6471b972103add0f2cfa20
176c2eab8b43e7bf11657a79a3731c9b
5877c0603f92d5e20444efec794f353b
96430ab5cf73ca69b197a6472302e85a
SUSE LINUX 10.1:
61f05d68428c52f0d57716d6d62709e8
0803b872488e152fae33f5bf1275b9b1
cd10ab26a88cda6662c0d1713f4a4e3d
13495741022e073b3c472bfe1a9c7c6d
dd085255e5fd7be2c828986a9f13cf19
3c62d4438255d17614141779738e5658
86ec9fd15372f8a7ee22032fab26ebcb
4922fb3414d40b886277b2d0d49dc3a6
173c364b3d412e93091e232b61bd9357
3a46b6ca7b50724f8a6ee7a459942737
4d48fda160f9273b429fc330b1fa660c
3a0ff7f2ca260c75d48dcb64bf5b9738
e3a150973083a86aab1aa69892c48d61
aff6c7c9065e95f8759e2f37dfb29bd1
0d25dddefc48bf4884ffa8a6f71adbce
7a9b0a8e151a345abe93d7e159dfc3c7
SUSE LINUX 10.0:
235c616cc45e73bf7ba8ae355586a9e0
6ff2cc6b8e9fab4a2ae4e3f8b71f6355
8a93258c7cd76c74dc52108a33debb42
5d1cec6db7ab0117fffe7298a3b93674
cd77633f2483244045b04ff537d86b1e
ee57327f97331acca368b29dbf373539
9606a2ff36bedebbb58f3ca5d4942c6d
9933661bee10627949a0f4265de66460
04badcfe4a39ab6d7ef8e8f732483a9f
5fb14175c631ab41136d54bb8ef5ac2c
c91cc42dd45e8c0830f734fff805e099
88ae6b69f90a6c36124f197ad67a6e6e
Sources:
openSUSE 10.3:
377b122f8a797b73fa289a6863e0f6c9
9459f613ca8a1feeb1bb76cdc843c8f5
openSUSE 10.2:
02d13237b7a9fd3bf3bd3fd6d8b25fac
617364e094a2044cc011d44221dad060
SUSE LINUX 10.1:
e809cb2ec420d242aaab06df79ed1a28
89ae8b67d0e65efdb451ab408a5c36c2
SUSE LINUX 10.0:
a159ce0e9ac9e5700ffd08f5e9287a67
Our maintenance customers are notified individually. The packages are
offered for installation from the maintenance web:
Open Enterprise Server
http://support.novell.com/techcenter/psdb/a8a615405c62005f443b3e34d922d381.html
Novell Linux POS 9
http://support.novell.com/techcenter/psdb/a8a615405c62005f443b3e34d922d381.html
Novell Linux Desktop 9
http://support.novell.com/techcenter/psdb/a8a615405c62005f443b3e34d922d381.html
SUSE SLES 9
http://support.novell.com/techcenter/psdb/a8a615405c62005f443b3e34d922d381.html
UnitedLinux 1.0
http://support.novell.com/techcenter/psdb/4aacd60f39d38eea0965ae4a284e6214.html
SuSE Linux Openexchange Server 4
http://support.novell.com/techcenter/psdb/4aacd60f39d38eea0965ae4a284e6214.html
SuSE Linux Enterprise Server 8
http://support.novell.com/techcenter/psdb/4aacd60f39d38eea0965ae4a284e6214.html
SuSE Linux Standard Server 8
http://support.novell.com/techcenter/psdb/4aacd60f39d38eea0965ae4a284e6214.html
SuSE Linux School Server
http://support.novell.com/techcenter/psdb/4aacd60f39d38eea0965ae4a284e6214.html
SUSE LINUX Retail Solution 8
http://support.novell.com/techcenter/psdb/4aacd60f39d38eea0965ae4a284e6214.html
SuSE Linux Desktop 1.0
http://support.novell.com/techcenter/psdb/4aacd60f39d38eea0965ae4a284e6214.html
SUSE Linux Enterprise Server 10 SP1
http://support.novell.com/techcenter/psdb/fbb935b5e53729bf34003933950a015a.html
SLE SDK 10 SP1
http://support.novell.com/techcenter/psdb/fbb935b5e53729bf34003933950a015a.html
SUSE Linux Enterprise Desktop 10 SP1
http://support.novell.com/techcenter/psdb/fbb935b5e53729bf34003933950a015a.html
______________________________________________________________________________
5) Pending Vulnerabilities, Solutions, and Work-Arounds:
Please consult the weekly summary report.
______________________________________________________________________________
6) Authenticity Verification and Additional Information
- Announcement authenticity verification:
SUSE security announcements are published via mailing lists and on Web
sites. The authenticity and integrity of a SUSE security announcement is
guaranteed by a cryptographic signature in each announcement. All SUSE
security announcements are published with a valid signature.
To verify the signature of the announcement, save it as text into a file
and run the command
gpg --verify
replacing with the name of the file where you saved the
announcement. The output for a valid signature looks like:
gpg: Signature made using RSA key ID 3D25D3D9
gpg: Good signature from "SuSE Security Team "
where is replaced by the date the document was signed.
If the security team's key is not contained in your key ring, you can
import it from the first installation CD. To import the key, use the
command
gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc
- Package authenticity verification:
SUSE update packages are available on many mirror FTP servers all over the
world. While this service is considered valuable and important to the free
and open source software community, the authenticity and the integrity of
a package needs to be verified to ensure that it has not been tampered
with.
There are two verification methods that can be used independently from
each other to prove the authenticity of a downloaded file or RPM package:
1) Using the internal gpg signatures of the rpm package
2) MD5 checksums as provided in this announcement
1) The internal rpm package signatures provide an easy way to verify the
authenticity of an RPM package. Use the command
rpm -v --checksig
to verify the signature of the package, replacing with the
filename of the RPM package downloaded. The package is unmodified if it
contains a valid signature from build@suse.de with the key ID 9C800ACA.
This key is automatically imported into the RPM database (on
RPMv4-based distributions) and the gpg key ring of 'root' during
installation. You can also find it on the first installation CD and at
the end of this announcement.
2) If you need an alternative means of verification, use the md5sum
command to verify the authenticity of the packages. Execute the command
md5sum
after you downloaded the file from a SUSE FTP server or its mirrors.
Then compare the resulting md5sum with the one that is listed in the
SUSE security announcement. Because the announcement containing the
checksums is cryptographically signed (by security@suse.de), the
checksums show proof of the authenticity of the package if the
signature of the announcement is valid. Note that the md5 sums
published in the SUSE Security Announcements are valid for the
respective packages only. Newer versions of these packages cannot be
verified.
- SUSE runs two security mailing lists to which any interested party may
subscribe:
opensuse-security@opensuse.org
- General Linux and SUSE security discussion.
All SUSE security announcements are sent to this list.
To subscribe, send an e-mail to
.
opensuse-security-announce@opensuse.org
- SUSE's announce-only mailing list.
Only SUSE's security announcements are sent to this list.
To subscribe, send an e-mail to
.
==================================================================== SUSE's security contact is or .
The public key is listed below.
====================================================================
