- ---------------------------------------------------------------------                   Red Hat Security Advisory

Synopsis:          Moderate: samba security update
Advisory ID:       RHSA-2007:0061-02
Advisory URL:      https://access.redhat.com/errata/RHSA-2007:0061.html
Issue date:        2007-03-14
Updated on:        2007-03-14
Product:           Red Hat Enterprise Linux
CVE Names:         CVE-2007-0452 
- ---------------------------------------------------------------------1. Summary:

Updated samba packages that fix a denial of service vulnerability are now
available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64

3. Problem description:

Samba provides file and printer sharing services to SMB/CIFS clients.

A denial of service flaw was found in Samba's smbd daemon process. An
authenticated user could send a specially crafted request which would cause
a smbd child process to enter an infinite loop condition. By opening
multiple CIFS sessions, an attacker could exhaust system resources
(CVE-2007-0452).

Users of Samba should update to these packages, which contain a
backported patch to correct this issue.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.  

This update is available via Red Hat Network.  Details on how to use 
the Red Hat Network to apply this update are available at


5. Bug IDs fixed (http://bugzilla.redhat.com/):

225519 - CVE-2007-0452 Samba smbd denial of service

6. RPMs required:

Red Hat Enterprise Linux Desktop (v. 5 client):

SRPMS:
b9f0c930e596610146f3f4d22461cf2e  samba-3.0.23c-2.el5.2.src.rpm

i386:
4376969ef05a38386a8a86b1bc6b07b3  samba-3.0.23c-2.el5.2.i386.rpm
1454b468e11fc429da90d704a7c5f791  samba-client-3.0.23c-2.el5.2.i386.rpm
16a459ee79fe73edacad0c98d12a14d2  samba-common-3.0.23c-2.el5.2.i386.rpm
2a82d8e06843ad076deaa5ca7c0af50e  samba-debuginfo-3.0.23c-2.el5.2.i386.rpm
8e078f1407f14fa52780d8ef488726be  samba-swat-3.0.23c-2.el5.2.i386.rpm

x86_64:
901320e342fd069aa87098c0e5dc3b2b  samba-3.0.23c-2.el5.2.x86_64.rpm
ed4f873bcd6c85e5bd96f4dab7403a1f  samba-client-3.0.23c-2.el5.2.x86_64.rpm
16a459ee79fe73edacad0c98d12a14d2  samba-common-3.0.23c-2.el5.2.i386.rpm
28dcc7b44ccce83118aac405a37e2a13  samba-common-3.0.23c-2.el5.2.x86_64.rpm
2a82d8e06843ad076deaa5ca7c0af50e  samba-debuginfo-3.0.23c-2.el5.2.i386.rpm
f0815980251cadeef8a6b2e10a8d9a94  samba-debuginfo-3.0.23c-2.el5.2.x86_64.rpm
25eb4104ac88c7db7eed56f08987cd70  samba-swat-3.0.23c-2.el5.2.x86_64.rpm

Red Hat Enterprise Linux (v. 5 server):

SRPMS:
b9f0c930e596610146f3f4d22461cf2e  samba-3.0.23c-2.el5.2.src.rpm

i386:
4376969ef05a38386a8a86b1bc6b07b3  samba-3.0.23c-2.el5.2.i386.rpm
1454b468e11fc429da90d704a7c5f791  samba-client-3.0.23c-2.el5.2.i386.rpm
16a459ee79fe73edacad0c98d12a14d2  samba-common-3.0.23c-2.el5.2.i386.rpm
2a82d8e06843ad076deaa5ca7c0af50e  samba-debuginfo-3.0.23c-2.el5.2.i386.rpm
8e078f1407f14fa52780d8ef488726be  samba-swat-3.0.23c-2.el5.2.i386.rpm

ia64:
f19aecd0327538f56455e54cdb3ccf20  samba-3.0.23c-2.el5.2.ia64.rpm
bccc097f869bc43b91fa4eb35e1e9249  samba-client-3.0.23c-2.el5.2.ia64.rpm
95d95f23f1384a5410bf54465399b022  samba-common-3.0.23c-2.el5.2.ia64.rpm
0bf86c4e53549f8768bc97cb040d1917  samba-debuginfo-3.0.23c-2.el5.2.ia64.rpm
7afd29addffd0835eb8d893832a3036a  samba-swat-3.0.23c-2.el5.2.ia64.rpm

ppc:
df4ca6d488bc7ed247f2a4a12b6e193a  samba-3.0.23c-2.el5.2.ppc.rpm
8a8f2df3bd72b7abd7439125c924b296  samba-client-3.0.23c-2.el5.2.ppc.rpm
66f5bc534bc003dc901495b6ea83052a  samba-common-3.0.23c-2.el5.2.ppc.rpm
633739582b5e6310bb6fb96aa2469552  samba-common-3.0.23c-2.el5.2.ppc64.rpm
f3d55887555dda82400dbe2dadb81f5e  samba-debuginfo-3.0.23c-2.el5.2.ppc.rpm
5ce6fe708dd9a117e528fb445cfda954  samba-debuginfo-3.0.23c-2.el5.2.ppc64.rpm
f2a619484d20fd94a0cf4414228216cc  samba-swat-3.0.23c-2.el5.2.ppc.rpm

s390x:
251635f6d0f5cbde27aa105289e38b7d  samba-3.0.23c-2.el5.2.s390x.rpm
d24679151bfa4ee38dd34dacf64f739a  samba-client-3.0.23c-2.el5.2.s390x.rpm
c8c0e08334f306279a7133ad1f126190  samba-common-3.0.23c-2.el5.2.s390.rpm
1a0c32a0758814818dccd46162925c2f  samba-common-3.0.23c-2.el5.2.s390x.rpm
294c8592f8817965aa1cabc8b1ae7297  samba-debuginfo-3.0.23c-2.el5.2.s390.rpm
1a2d8e1b8172798000a5a507f20d48ad  samba-debuginfo-3.0.23c-2.el5.2.s390x.rpm
0e2b6e82f64c5d77eb769fafa58dc7b9  samba-swat-3.0.23c-2.el5.2.s390x.rpm

x86_64:
901320e342fd069aa87098c0e5dc3b2b  samba-3.0.23c-2.el5.2.x86_64.rpm
ed4f873bcd6c85e5bd96f4dab7403a1f  samba-client-3.0.23c-2.el5.2.x86_64.rpm
16a459ee79fe73edacad0c98d12a14d2  samba-common-3.0.23c-2.el5.2.i386.rpm
28dcc7b44ccce83118aac405a37e2a13  samba-common-3.0.23c-2.el5.2.x86_64.rpm
2a82d8e06843ad076deaa5ca7c0af50e  samba-debuginfo-3.0.23c-2.el5.2.i386.rpm
f0815980251cadeef8a6b2e10a8d9a94  samba-debuginfo-3.0.23c-2.el5.2.x86_64.rpm
25eb4104ac88c7db7eed56f08987cd70  samba-swat-3.0.23c-2.el5.2.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0452
http://www.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is .  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2007 Red Hat, Inc.