Vulnerability Bulletins |
Múltiples vulnerabilidades en Samba |
|
Vulnerability classification |
|
| Property | Value |
| Confidence level | Oficial |
| Impact | Obtener acceso |
| Dificulty | Experto |
| Required attacker level | Acceso remoto con cuenta |
System information |
|
| Property | Value |
| Affected manufacturer | GNU/Linux |
| Affected software |
Samba 3.0.x < 3.0.35, Samba 3.1.x y 3.2.x < 3.2.13 Samba 3.3.x < 3.3.6 Solaris 9 Operating System Solaris 10 Operating System OpenSolaris |
Description |
|
|
Se han descubierto múltiples vulnerabilidades en Samba. Las vulnerabilidades son descritas a continuación: - CVE-2009-1886: Se han descubierto múltiples vulnerabilidades de formato de string. La vulnerabilidad reside en un error en "client/client.c" en smbclient. Un atacante remoto podría ejecutar código arbitrario mediante un formato de cadena específico en un nombre de fichero. - CVE-2009-1888: La vulnerabilidad reside en un error en la función "acl_group_override" en "smbd/posix_acls.c". Un atacante remoto podría modificar las listas de contro de acceso a ficheros mediante métodos relacionados con el acceso a memoria no inicializada. |
|
Solution |
|
|
Actualización de software Debian (DSA-1823-1) Debian Linux 5.0 Source http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5.orig.tar.gz http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny6.dsc http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny6.diff.gz Arquitectura independiente: http://security.debian.org/pool/updates/main/s/samba/samba-doc_3.2.5-4lenny6_all.deb http://security.debian.org/pool/updates/main/s/samba/samba-doc-pdf_3.2.5-4lenny6_all.deb alpha (DEC Alpha) http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny6_alpha.deb http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny6_alpha.deb http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny6_alpha.deb http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny6_alpha.deb http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny6_alpha.deb http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny6_alpha.deb http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny6_alpha.deb http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny6_alpha.deb http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny6_alpha.deb http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny6_alpha.deb http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny6_alpha.deb http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny6_alpha.deb amd64 (AMD x86_64 (AMD64)) http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny6_amd64.deb http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny6_amd64.deb http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny6_amd64.deb http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny6_amd64.deb http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny6_amd64.deb http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny6_amd64.deb http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny6_amd64.deb http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny6_amd64.deb http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny6_amd64.deb http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny6_amd64.deb http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny6_amd64.deb http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny6_amd64.deb arm (ARM) http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny6_arm.deb http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny6_arm.deb http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny6_arm.deb http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny6_arm.deb http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny6_arm.deb http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny6_arm.deb http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny6_arm.deb http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny6_arm.deb http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny6_arm.deb http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny6_arm.deb http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny6_arm.deb http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny6_arm.deb armel (ARM EABI) http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny6_armel.deb http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny6_armel.deb http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny6_armel.deb http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny6_armel.deb http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny6_armel.deb http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny6_armel.deb http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny6_armel.deb http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny6_armel.deb http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny6_armel.deb http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny6_armel.deb http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny6_armel.deb http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny6_armel.deb hppa (HP PA RISC) http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny6_hppa.deb http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny6_hppa.deb http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny6_hppa.deb http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny6_hppa.deb http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny6_hppa.deb http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny6_hppa.deb http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny6_hppa.deb http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny6_hppa.deb http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny6_hppa.deb http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny6_hppa.deb http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny6_hppa.deb http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny6_hppa.deb i386 (Intel ia32) http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny6_i386.deb http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny6_i386.deb http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny6_i386.deb http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny6_i386.deb http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny6_i386.deb http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny6_i386.deb http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny6_i386.deb http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny6_i386.deb http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny6_i386.deb http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny6_i386.deb http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny6_i386.deb http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny6_i386.deb ia64 (Intel ia64) http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny6_ia64.deb http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny6_ia64.deb http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny6_ia64.deb http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny6_ia64.deb http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny6_ia64.deb http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny6_ia64.deb http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny6_ia64.deb http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny6_ia64.deb http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny6_ia64.deb http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny6_ia64.deb http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny6_ia64.deb http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny6_ia64.deb mips (MIPS (Big Endian)) http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny6_mips.deb http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny6_mips.deb http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny6_mips.deb http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny6_mips.deb http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny6_mips.deb http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny6_mips.deb http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny6_mips.deb http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny6_mips.deb http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny6_mips.deb http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny6_mips.deb http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny6_mips.deb http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny6_mips.deb mipsel (MIPS (Little Endian)) http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny6_mipsel.deb http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny6_mipsel.deb http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny6_mipsel.deb http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny6_mipsel.deb http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny6_mipsel.deb http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny6_mipsel.deb http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny6_mipsel.deb http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny6_mipsel.deb http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny6_mipsel.deb http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny6_mipsel.deb http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny6_mipsel.deb http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny6_mipsel.deb powerpc (PowerPC) http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny6_powerpc.deb http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny6_powerpc.deb http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny6_powerpc.deb http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny6_powerpc.deb http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny6_powerpc.deb http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny6_powerpc.deb http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny6_powerpc.deb http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny6_powerpc.deb http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny6_powerpc.deb http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny6_powerpc.deb http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny6_powerpc.deb http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny6_powerpc.deb s390 (IBM S/390) http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny6_s390.deb http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny6_s390.deb http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny6_s390.deb http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny6_s390.deb http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny6_s390.deb http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny6_s390.deb http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny6_s390.deb http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny6_s390.deb http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny6_s390.deb http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny6_s390.deb http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny6_s390.deb http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny6_s390.deb sparc (Sun SPARC/UltraSPARC) http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny6_sparc.deb http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny6_sparc.deb http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny6_sparc.deb http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny6_sparc.deb http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny6_sparc.deb http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny6_sparc.deb http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny6_sparc.deb http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny6_sparc.deb http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny6_sparc.deb http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny6_sparc.deb http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny6_sparc.deb http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny6_sparc.deb Sun (267628) Solaris10 / SPARC / patch 119757-16 o posterior Solaris 10 / x86 / patch 119758-16 o posterior OpenSolaris / upon builds snv_119 o posterior http://sunsolve.sun.com/pub-cgi/show.pl?target=patchpage Red Hat (RHSA-2009:1585-1) RHEL Desktop Supplementary (v. 5 cliente) RHEL Supplementary (v. 5 servidor) RHEL Supplementary EUS (v. 5.4.z servidor) https://rhn.redhat.com/ |
|
Standar resources |
|
| Property | Value |
| CVE |
CVE-2009-1886 CVE-2009-1888 |
| BID | 35472 |
Other resources |
|
|
Debian Security Advisory (DSA-1823-1) http://lists.debian.org/debian-security-announce/2009/msg00135.html Sun Alert Notification (267628) http://sunsolve.sun.com/search/document.do?assetkey=1-66-267628-1 Red Hat Security Advisory (RHSA-2009:1585-1) https://rhn.redhat.com/errata/RHSA-2009-1585.html |
|
Version history |
||
| Version | Comments | Date |
| 1.0 | Aviso emitido | 2009-07-02 |
| 1.1 | Aviso emitido por Sun (267628) | 2009-09-29 |
| 1.2 | Aviso emitido por Red Hat (RHSA-2009:1585-1) | 2009-11-24 |