LinuxSecurity.com
Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Welcome!
Sign up!
EnGarde Community
Login
Polls
What is the most important Linux security technology?
 
Advisories
Community
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
SELinux
White Papers
Featured Blogs
All About Linux
DanWalsh LiveJournal
Securitydistro
Latest Newsletters
Linux Security Week: December 22nd, 2014
Linux Advisory Watch: December 19th, 2014
Subscribe
LinuxSecurity Newsletters
E-mail:
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

  
RedHat: 'samba' potential symlink vulnerability Print E-mail
User Rating:      How can I rate this item?
Posted by LinuxSecurity.com Team   
RedHat Linux These packages fix a security problem with remote clients giving specialNetBIOS names to the server.

---------------------------------------------------------------------
                   Red Hat, Inc. Red Hat Security Advisory

Synopsis:          New Samba packages available for Red Hat Linux 5.2, 6.2, 7 and 7.1
Advisory ID:       RHSA-2001:086-06
Issue date:        2001-06-23
Updated on:        2001-06-25
Product:           Red Hat Linux
Keywords:          samba /tmp overwrite netbios log
Cross references:  
Obsoletes:         RHSA-2001:044
---------------------------------------------------------------------

1. Topic:

New Samba packages are available for Red Hat Linux 5.2, 6.2, 7 and 7.1.
These packages fix a security problem with remote clients giving special
NetBIOS names to the server.

It is recommended that all Samba users upgrade to the fixed packages.
Please note that the packages for Red Hat Linux 6.2 require an updated
logrotate package.

2. Relevant releases/architectures:

Red Hat Linux 5.2 - alpha, i386, sparc

Red Hat Linux 6.2 - alpha, i386, sparc

Red Hat Linux 7.0 - alpha, i386

Red Hat Linux 7.1 - alpha, i386

3. Problem description:

The Samba configuration used in Red Hat Linux logs operations into
[remotenetbiosname].log. By sending an invalid netbiosname, Samba could be
fooled to write its log in unintended and inappropriate locations. This can
be especially dangerous if combined with a symlink created by a local user.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade.  Only those
RPMs which are currently installed will be updated.  Those RPMs which are
not installed but included in the list will not be updated.  Note that you
can also use wildcards (*.rpm) if your current directory *only* contains
the
desired RPMs.

Please note that this update is also available via Red Hat Network.  Many
people find this an easier way to apply updates.  To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

5. Bug IDs fixed  (http://bugzilla.Red Hat.com/bugzilla for more info):



6. RPMs required:

Red Hat Linux 5.2:

SRPMS: 
ftp://updates.Red Hat.com/5.2/en/os/SRPMS/samba-2.0.10-0.52.src.rpm

alpha: 
ftp://updates.Red Hat.com/5.2/en/os/alpha/samba-2.0.10-0.52.alpha.rpm 
ftp://updates.Red Hat.com/5.2/en/os/alpha/samba-client-2.0.10-0.52.alpha.rpm

i386: 
ftp://updates.Red Hat.com/5.2/en/os/i386/samba-2.0.10-0.52.i386.rpm 
ftp://updates.Red Hat.com/5.2/en/os/i386/samba-client-2.0.10-0.52.i386.rpm

sparc: 
ftp://updates.Red Hat.com/5.2/en/os/sparc/samba-2.0.10-0.52.sparc.rpm 
ftp://updates.Red Hat.com/5.2/en/os/sparc/samba-client-2.0.10-0.52.sparc.rpm

Red Hat Linux 6.2:

SRPMS: 
ftp://updates.Red Hat.com/6.2/en/os/SRPMS/samba-2.0.10-0.62.src.rpm

alpha: 
ftp://updates.Red Hat.com/6.2/en/os/alpha/samba-2.0.10-0.62.alpha.rpm 
ftp://updates.Red Hat.com/6.2/en/os/alpha/samba-common-2.0.10-0.62.alpha.rpm 
ftp://updates.Red Hat.com/6.2/en/os/alpha/samba-client-2.0.10-0.62.alpha.rpm

i386: 
ftp://updates.Red Hat.com/6.2/en/os/i386/samba-2.0.10-0.62.i386.rpm 
ftp://updates.Red Hat.com/6.2/en/os/i386/samba-common-2.0.10-0.62.i386.rpm 
ftp://updates.Red Hat.com/6.2/en/os/i386/samba-client-2.0.10-0.62.i386.rpm

sparc: 
ftp://updates.Red Hat.com/6.2/en/os/sparc/samba-2.0.10-0.62.sparc.rpm 
ftp://updates.Red Hat.com/6.2/en/os/sparc/samba-common-2.0.10-0.62.sparc.rpm 
ftp://updates.Red Hat.com/6.2/en/os/sparc/samba-client-2.0.10-0.62.sparc.rpm

Red Hat Linux 7.0:

SRPMS: 
ftp://updates.Red Hat.com/7.0/en/os/SRPMS/samba-2.0.10-0.7.src.rpm

alpha: 
ftp://updates.Red Hat.com/7.0/en/os/alpha/samba-2.0.10-0.7.alpha.rpm 
ftp://updates.Red Hat.com/7.0/en/os/alpha/samba-common-2.0.10-0.7.alpha.rpm 
ftp://updates.Red Hat.com/7.0/en/os/alpha/samba-client-2.0.10-0.7.alpha.rpm

i386: 
ftp://updates.Red Hat.com/7.0/en/os/i386/samba-2.0.10-0.7.i386.rpm 
ftp://updates.Red Hat.com/7.0/en/os/i386/samba-common-2.0.10-0.7.i386.rpm 
ftp://updates.Red Hat.com/7.0/en/os/i386/samba-client-2.0.10-0.7.i386.rpm

Red Hat Linux 7.1:

SRPMS: 
ftp://updates.Red Hat.com/7.1/en/os/SRPMS/samba-2.0.10-2.src.rpm

alpha: 
ftp://updates.Red Hat.com/7.1/en/os/alpha/samba-2.0.10-2.alpha.rpm 
ftp://updates.Red Hat.com/7.1/en/os/alpha/samba-common-2.0.10-2.alpha.rpm 
ftp://updates.Red Hat.com/7.1/en/os/alpha/samba-client-2.0.10-2.alpha.rpm 
ftp://updates.Red Hat.com/7.1/en/os/alpha/samba-swat-2.0.10-2.alpha.rpm

i386: 
ftp://updates.Red Hat.com/7.1/en/os/i386/samba-2.0.10-2.i386.rpm 
ftp://updates.Red Hat.com/7.1/en/os/i386/samba-common-2.0.10-2.i386.rpm 
ftp://updates.Red Hat.com/7.1/en/os/i386/samba-client-2.0.10-2.i386.rpm 
ftp://updates.Red Hat.com/7.1/en/os/i386/samba-swat-2.0.10-2.i386.rpm



7. Verification:

MD5 sum                           Package Name
--------------------------------------------------------------------------
18df4fbdfa8594ea680595109964b409 5.2/en/os/SRPMS/samba-2.0.10-0.52.src.rpm
cdf3e062dcaa6aa340e31e5cec5f0344 5.2/en/os/alpha/samba-2.0.10-0.52.alpha.rpm
604b9008fc1250d5c5a50d25988bc4b1 5.2/en/os/alpha/samba-client-2.0.10-0.52.alpha.rpm
9f65bdf5755a55a1c700067dc4b7c3c9 5.2/en/os/i386/samba-2.0.10-0.52.i386.rpm
79c327d3ef532cb64700a2ce0d5e66a0 5.2/en/os/i386/samba-client-2.0.10-0.52.i386.rpm
a272092d5287bfe60671ac1e9492b1ec 5.2/en/os/sparc/samba-2.0.10-0.52.sparc.rpm
793af6719cbee2d0b15677e5a0943f1c 5.2/en/os/sparc/samba-client-2.0.10-0.52.sparc.rpm
c6c163dc45803cce27d6c9ac4980b312 6.2/en/os/SRPMS/samba-2.0.10-0.62.src.rpm
346698143be2b970ab7b9a2daa4cb482 6.2/en/os/alpha/samba-2.0.10-0.62.alpha.rpm
66ec9df3884ea11dcc9aa65f9c00c0b9 6.2/en/os/alpha/samba-client-2.0.10-0.62.alpha.rpm
fd65e0789cf5cb77b1cca71dd5d0cbe6 6.2/en/os/alpha/samba-common-2.0.10-0.62.alpha.rpm
fe5cb3e1c2d85b609a23e8e6b9e18032 6.2/en/os/i386/samba-2.0.10-0.62.i386.rpm
592952ec4e6ebba775453790bff9f55c 6.2/en/os/i386/samba-client-2.0.10-0.62.i386.rpm
7aaab8758112c7eea1b9f5f82a618ccb 6.2/en/os/i386/samba-common-2.0.10-0.62.i386.rpm
0abcd0238a18311c26eba967a8256c5b 6.2/en/os/sparc/samba-2.0.10-0.62.sparc.rpm
e21c51775e7af1aace2b76e0a36f126f 6.2/en/os/sparc/samba-client-2.0.10-0.62.sparc.rpm
513e63a960296b3cbdaac634f5641301 6.2/en/os/sparc/samba-common-2.0.10-0.62.sparc.rpm
1db7800a8973a157fe350c4073492a24 7.0/en/os/SRPMS/samba-2.0.10-0.7.src.rpm
b23b1930ff12b4b5baed47c6f58ea204 7.0/en/os/alpha/samba-2.0.10-0.7.alpha.rpm
d3dbd761b1b9aed27e2675bb8b0746df 7.0/en/os/alpha/samba-client-2.0.10-0.7.alpha.rpm
44d4aee596d2a775f2a79e873b93dd54 7.0/en/os/alpha/samba-common-2.0.10-0.7.alpha.rpm
bab37137760e9955f8764a076c67c9ae 7.0/en/os/i386/samba-2.0.10-0.7.i386.rpm
826b1e504046b33ea5a979092fa54131 7.0/en/os/i386/samba-client-2.0.10-0.7.i386.rpm
3362bb219401f80c852614ec779d071e 7.0/en/os/i386/samba-common-2.0.10-0.7.i386.rpm
c2d3bdaec859f09d31bcc14727e59918 7.1/en/os/SRPMS/samba-2.0.10-2.src.rpm
994f39fc465bb4dae3a94c2e0b608b4a 7.1/en/os/alpha/samba-2.0.10-2.alpha.rpm
ca0e8961ccfa6f78ab6e9155b7068b20 7.1/en/os/alpha/samba-client-2.0.10-2.alpha.rpm
ed3b2c72b04581f5345baf85044ff2e1 7.1/en/os/alpha/samba-common-2.0.10-2.alpha.rpm
59510f5d9f8bca09c35d5fa3fbb04553 7.1/en/os/alpha/samba-swat-2.0.10-2.alpha.rpm
988c5e7b554b659827897e52f8d13784 7.1/en/os/i386/samba-2.0.10-2.i386.rpm
9d5e0051d258f875236c3a317611f333 7.1/en/os/i386/samba-client-2.0.10-2.i386.rpm
5fe71e403bfd27da1de2325b734d28f8 7.1/en/os/i386/samba-common-2.0.10-2.i386.rpm
dc667f249bd0c9024dcf751e513962f4 7.1/en/os/i386/samba-swat-2.0.10-2.i386.rpm

These packages are GPG signed by Red Hat, Inc. for security.  Our key
is available at:
     http://www.Red Hat.com/corp/contact.html

You can verify each package with the following command:
    rpm --checksig  

If you only wish to verify that each package has not been corrupted or
tampered with, examine only the md5sum with the following command:
    rpm --checksig --nogpg 

8. References:




Copyright(c) 2000, 2001 Red Hat, Inc.

 
< Prev   Next >
    
Partner

 

Latest Features
Peter Smith Releases Linux Network Security Online
Securing a Linux Web Server
Password guessing with Medusa 2.0
Password guessing as an attack vector
Squid and Digest Authentication
Squid and Basic Authentication
Demystifying the Chinese Hacking Industry: Earning 6 Million a Night
Free Online security course (LearnSIA) - A Call for Help
What You Need to Know About Linux Rootkits
Review: A Practical Guide to Fedora and Red Hat Enterprise Linux - Fifth Edition
Weekend Edition
Report: U.S. planning “proportional response” to Sony hack, blamed on North Korea
Heartbleed, Shellshock, Tor and more: The 13 biggest security stories of 2014
Partner Sponsor

Community | HOWTOs | Blogs | Features | Book Reviews | Networking
 Security Projects |  Latest News |  Newsletters |  SELinux |  Privacy |  Home
 Hardening |   About Us |   Advertise |   Legal Notice |   RSS |   Guardian Digital
(c)Copyright 2014 Guardian Digital, Inc. All rights reserved.