Mandrake: 'samba' vulnerability
Posted by LinuxSecurity.com Team   
Mandrake Michal Zalewski has found a vulnerability in all versions of Samba prior to 2.0.10 where if a client sends an invalid netbios name Samba could be tricked into appending it's log to files writable by root.

________________________________________________________________________

                Mandrake Linux Security Update Advisory
________________________________________________________________________

Package name:           samba
Date:                   June 29th, 2001
Advisory ID:            MDKSA-2001:062

Affected versions:      7.1, 7.2, 8.0, Corporate Server 1.0.1
________________________________________________________________________

Problem Description:

 Michal Zalewski has found a vulnerability in all versions of Samba
 prior to 2.0.10 where if a client sends an invalid netbios name Samba
 could be tricked into appending it's log to files writable by root.
 This can be very dangerous if combined with a symlink created by a
 local user.  Note that the log files must be specified as %m.log in
 order for this to work, and Mandrake Linux ships Samba by default
 using log.%m, thus it is not vulnerable "out of the box".
________________________________________________________________________

References:

  http://us1.samba.org/samba/whatsnew/macroexploit.html
________________________________________________________________________

Please verify the update prior to upgrading to ensure the integrity of
the downloaded package.  You can do this with the command:
  rpm --checksig package.rpm
You can get the GPG public key of the Mandrake Linux Security Team at
   http://www.linux-mandrake.com/en/security/RPM-GPG-KEYS
If you use MandrakeUpdate, the verification of md5 checksum and GPG
signature is performed automatically for you.

Linux-Mandrake 7.1:
56c2fd045833640c08f5380576f16410  7.1/RPMS/samba-2.0.10-1.3mdk.i586.rpm
c377973bfd8b699678e64d9a9b1674a3  7.1/RPMS/samba-client-2.0.10-1.3mdk.i586.rpm
030523ef3ac70fced03849c478c1ebfe  7.1/RPMS/samba-common-2.0.10-1.3mdk.i586.rpm
6a1e2d71492868704051133c7cea7f60  7.1/SRPMS/samba-2.0.10-1.3mdk.src.rpm

Linux-Mandrake 7.2:
991fdcad4c631cfa060bbc21374d2dd8  7.2/RPMS/samba-2.0.10-1.2mdk.i586.rpm
1da8547bb88864fd974f85efcd2643de  7.2/RPMS/samba-client-2.0.10-1.2mdk.i586.rpm
56420cded466e9a86b3159d2071fcb10  7.2/RPMS/samba-common-2.0.10-1.2mdk.i586.rpm
a5069f151064c25b4eafafb5e664c6e7  7.2/SRPMS/samba-2.0.10-1.2mdk.src.rpm

Mandrake Linux 8.0:
74c9279dfa603c53bb6d3849a6d8cb02  8.0/RPMS/samba-2.0.10-1.1mdk.i586.rpm
c2c233ff7fc7154605fde704667beee6  8.0/RPMS/samba-client-2.0.10-1.1mdk.i586.rpm
baaa778fe9e7c7bea536ebf827c02297  8.0/RPMS/samba-common-2.0.10-1.1mdk.i586.rpm
449f10822df5ccc49f839159e71a2019  8.0/SRPMS/samba-2.0.10-1.1mdk.src.rpm

Corporate Server 1.0.1:
5143308e3d3fea7e4d2905476819019c  1.0.1/RPMS/samba-2.0.10-1.3mdk.i586.rpm
0bf16d228879342e07bd721d3acd32a3  1.0.1/RPMS/samba-client-2.0.10-1.3mdk.i586.rpm
f5a02b96c6865561d4685ab12ea1bbb2  1.0.1/RPMS/samba-common-2.0.10-1.3mdk.i586.rpm
6a1e2d71492868704051133c7cea7f60  1.0.1/SRPMS/samba-2.0.10-1.3mdk.src.rpm
________________________________________________________________________

Bug IDs fixed (see https://qa.mandrakesoft.com for more information):

________________________________________________________________________

To upgrade automatically, use MandrakeUpdate.

If you want to upgrade manually, download the updated package from one
of our FTP server mirrors and upgrade with "rpm -Fvh *.rpm".

You can download the updates directly from one of the mirror sites
listed at:

   http://www.linux-mandrake.com/en/ftp.php3.

Updated packages are available in the "updates/[ver]/RPMS/" directory.
For example, if you are looking for an updated RPM package for
Mandrake Linux 8.0, look for it in "updates/8.0/RPMS/".  Updated source
RPMs are available as well, but you generally do not need to download
them.

Please be aware that sometimes it takes the mirrors a few hours to
update.

You can view other security advisories for Mandrake Linux at:

   http://www.linux-mandrake.com/en/security/

If you want to report vulnerabilities, please contact

  security@linux-mandrake.com
________________________________________________________________________

Mandrake Linux has two security-related mailing list services that
anyone can subscribe to:

security-announce@linux-mandrake.com

  Mandrake Linux's security announcements mailing list.  Only
  announcements are sent to this list and it is read-only.

security-discuss@linux-mandrake.com

  Mandrake Linux's security discussion mailing list.  This list is open
  to anyone to discuss Mandrake Linux security specifically and Linux
  security in general.

To subscribe to either list, send a message to
  sympa@linux-mandrake.com
with "subscribe [listname]" in the body of the message.

To remove yourself from either list, send a message to
  sympa@linux-mandrake.com
with "unsubscribe [listname]" in the body of the message.

To get more information on either list, send a message to
  sympa@linux-mandrake.com
with "info [listname]" in the body of the message.

Optionally, you can use the web interface to subscribe to or unsubscribe
from either list:

   http://www.linux-mandrake.com/en/flists.php3#security
________________________________________________________________________