|
|
Family: Gentoo Local Security Checks --> Category: infos
[GLSA-200411-21] Samba: Multiple vulnerabilities Vulnerability Scan
Vulnerability Scan Summary
Samba: Multiple vulnerabilities
Detailed Explanation for this Vulnerability Test
The remote host is affected by the vulnerability described in GLSA-200411-21
(Samba: Multiple vulnerabilities)
Samba fails to do proper bounds checking when handling
TRANSACT2_QFILEPATHINFO replies. Additionally an input validation flaw
exists in ms_fnmatch.c when matching filenames that contain wildcards.
Impact
A possible hacker may be able to execute arbitrary code with the permissions
of the user running Samba. A remote attacker may also be able to cause
an abnormal consumption of CPU resources, resulting in slower
performance of the server or even a Denial of Service.
Workaround
There is no known workaround at this time.
References:
http://www.samba.org/samba/security/CAN-2004-0930.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0930
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0882
http://security.e-matters.de/advisories/132004.html
Solution:
All Samba users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-fs/samba-3.0.8"
Threat Level: Medium
Click HERE for more information and discussions on this network vulnerability scan.
|
