Ubuntu 12.04 LTS: USN-1434-1 Critical Samba Administrative Risk

ubuntu

May 1, 2012

Samba could allow a user to gain administrative privileges to the Samba server.

Summary

Samba could allow a user to gain administrative privileges to the Samba server.

Software Description:

- samba: SMB/CIFS file, print, and login server for Unix

Details:

Ivano Cristofolini discovered that Samba incorrectly handled some Local

Security Authority (LSA) remote procedure calls (RPC). A remote, authenticated

attacker could exploit this to grant administrative privileges to arbitrary

users. The administrative privileges could be used to bypass permission checks

performed by the Samba server.

Topics Covered

security advisory samba Ubuntu server security remote exploitation permission bypass administrative privilege

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
  samba                           2:3.6.3-2ubuntu2.1

Ubuntu 11.10:
  samba                           2:3.5.11~dfsg-1ubuntu2.3

Ubuntu 11.04:
  samba                           2:3.5.8~dfsg-1ubuntu2.5

Ubuntu 10.04 LTS:
  samba                           2:3.4.7~dfsg-1ubuntu3.10

After a standard system update you may need to review the privileges of Samba
user accounts.