Multiple vulnerabilities have been discovered in Samba, the worst of which can lead to remote code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-fs/samba | * | < 4.18.9 | >= 4.18.9 |
Samba is a suite of SMB and CIFS client/server programs.
Multiple vulnerabilities have been discovered in Samba. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All Samba users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-fs/samba-4.18.9"
Multiple vulnerabilities have been discovered in Samba, the worst of which could result in root remote code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-fs/samba | * | < 4.18.4 | >= 4.18.4 |
Samba is a suite of SMB and CIFS client/server programs.
Multiple vulnerabilities have been discovered in Samba. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All Samba users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-fs/samba-4.18.4"
Multiple vulnerabilities have been found in Samba, the worst of which could result in a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-fs/samba | * | < 4.13.8 | >= 4.13.8 |
Samba is a suite of SMB and CIFS client/server programs.
Multiple vulnerabilities have been discovered in Samba. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All Samba users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-fs/samba-4.13.8"
Multiple vulnerabilities have been found in Samba, the worst of which could result in a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-fs/samba | * | < 4.12.9 | >= 4.12.9 |
Samba is a suite of SMB and CIFS client/server programs.
Multiple vulnerabilities have been discovered in Samba. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All Samba users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-fs/samba-4.12.9"
Multiple vulnerabilities have been found in Samba, the worst of which could result in a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-fs/samba | * | < 4.11.11 | >= 4.11.11 |
Samba is a suite of SMB and CIFS client/server programs.
Multiple vulnerabilities have been discovered in Samba. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All Samba users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-fs/samba-4.11.11"
Multiple vulnerabilities have been found in Samba, the worst of which could lead to remote code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-fs/samba | * | < 4.11.6 | >= 4.9.18 (revision), >= 4.10.13 (revision), >= 4.11.6 (revision) |
Samba is a suite of SMB and CIFS client/server programs.
Multiple vulnerabilities have been discovered in Samba. Please review the CVE identifiers referenced below for details.
A remote attacker could possibly execute arbitrary code, cause a Denial of Service condition, conduct a man-in-the-middle attack, or obtain sensitive information.
There is no known workaround at this time.
All Samba 4.9.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-fs/samba-4.9.18"
All Samba 4.10.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-fs/samba-4.10.13"
All Samba 4.11.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-fs/samba-4.11.6"
Multiple vulnerabilities have been found in Samba, the worst of which may allow remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-fs/samba | * | < 4.5.16 | >= 4.5.16 |
Samba is a suite of SMB and CIFS client/server programs.
Multiple vulnerabilities have been discovered in Samba. Please review the CVE identifiers referenced below for details.
A remote attacker could possibly execute arbitrary code, cause a Denial of Service condition, conduct a man-in-the-middle attack, or obtain sensitive information.
There is no known workaround at this time.
All Samba users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-fs/samba-4.5.16"
Multiple vulnerabilities have been found in Samba, the worst of which may allow execution of arbitrary code with root privileges.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-fs/samba | * | < 4.2.11 | >= 4.2.11 |
Samba is a suite of SMB and CIFS client/server programs.
Multiple vulnerabilities have been discovered in samba. Please review the CVE identifiers referenced below for details.
A remote attacker could possibly execute arbitrary code with root privileges, cause a Denial of Service condition, conduct a man-in-the-middle attack, obtain sensitive information, or bypass file permissions.
There is no known workaround at this time.
All Samba users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-fs/samba-4.2.11"
Multiple vulnerabilities have been found in Samba, the worst of which allowing a context-dependent attacker to bypass intended file restrictions, cause a Denial of Service or execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-fs/samba | * | < 3.6.25 | >= 3.6.25 |
Samba is a suite of SMB and CIFS client/server programs.
Multiple vulnerabilities have been discovered in Samba. Please review the CVE identifiers referenced below for details.
A context-dependent attacker may be able to execute arbitrary code, cause a Denial of Service condition, bypass intended file restrictions, or obtain sensitive information.
There is no known workaround at this time.
All Samba users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-fs/samba-3.6.25"
Multiple vulnerabilities have been found in Samba, the worst of which may allow execution of arbitrary code with root privileges.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-fs/samba | * | < 3.5.15 | >= 3.5.15 |
Samba is a suite of SMB and CIFS client/server programs.
Multiple vulnerabilities have been discovered in Samba. Please review the CVE identifiers referenced below for details.
A remote attacker could possibly execute arbitrary code with root privileges, cause a Denial of Service condition, take ownership of shared files, or bypass file permissions. Furthermore, a local attacker may be able to cause a Denial of Service condition or obtain sensitive information in a Samba credentials file.
There is no known workaround at this time.
All Samba users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-fs/samba-3.5.15"
A missing boundary check in Samba might lead to the disclosure of memory contents.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-fs/samba | * | < 3.0.33 | >= 3.0.33 |
Samba is a suite of SMB and CIFS client/server programs.
Samba does not properly check memory boundaries when handling trans, rans2, and nttrans requests.
A remote attacker could send specially crafted requests to a Samba daemon, leading to the disclosure of arbitrary memory or to a Denial of Service.
There is no known workaround at this time.
All Samba users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-fs/samba-3.0.33"
A heap-based buffer overflow vulnerability was found in Samba, allowing for the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-fs/samba | * | < 3.0.28a-r1 | >= 3.0.28a-r1 |
Samba is a suite of SMB and CIFS client/server programs.
Alin Rad Pop (Secunia Research) reported a vulnerability in Samba within the receive_smb_raw() function in the file lib/util_sock.c when parsing SMB packets, possibly leading to a heap-based buffer overflow via an overly large SMB packet.
A remote attacker could possibly exploit this vulnerability by enticing a user to connect to a malicious server or by sending specially crafted packets to an nmbd server configured as a local or domain master browser, resulting in the execution of arbitrary code.
There is no known workaround at this time.
All Samba users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-fs/samba-3.0.28a-r1"
Samba contains a buffer overflow vulnerability potentially resulting in the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-fs/samba | * | < 3.0.28 | >= 3.0.28 |
Samba is a suite of SMB and CIFS client/server programs for UNIX.
Alin Rad Pop (Secunia Research) discovered a boundary checking error in the send_mailslot() function which could lead to a stack-based buffer overflow.
A remote attacker could send a specially crafted "SAMLOGON" domain logon packet, possibly leading to the execution of arbitrary code with elevated privileges. Note that this vulnerability is exploitable only when domain logon support is enabled in Samba, which is not the case in Gentoo's default configuration.
Disable domain logon in Samba by setting "domain logons = no" in the "global" section of your smb.conf and restart Samba.
All Samba users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-fs/samba-3.0.28"
Samba contains two buffer overflow vulnerabilities potentially resulting in the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-fs/samba | * | < 3.0.27a | >= 3.0.27a |
Samba is a suite of SMB and CIFS client/server programs for UNIX.
Two vulnerabilities have been reported in nmbd. Alin Rad Pop (Secunia Research) discovered a boundary checking error in the reply_netbios_packet() function which could lead to a stack-based buffer overflow (CVE-2007-5398). The Samba developers discovered a boundary error when processing GETDC logon requests also leading to a buffer overflow (CVE-2007-4572).
To exploit the first vulnerability, a remote unauthenticated attacker could send specially crafted WINS "Name Registration" requests followed by a WINS "Name Query" request. This might lead to execution of arbitrary code with elevated privileges. Note that this vulnerability is exploitable only when WINS server support is enabled in Samba. The second vulnerability could be exploited by sending specially crafted "GETDC" mailslot requests, but requires Samba to be configured as a Primary or Backup Domain Controller. It is not believed the be exploitable to execute arbitrary code.
To work around the first vulnerability, disable WINS support in Samba by setting "wins support = no" in the "global" section of your smb.conf and restart Samba.
All Samba users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-fs/samba-3.0.27a"
The first vulnerability (CVE-2007-5398) was already fixed in Samba 3.0.26a-r2.
Samba contains multiple vulnerabilities potentially resulting in the execution of arbitrary code with root privileges.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-fs/samba | * | < 3.0.24-r2 | >= 3.0.24-r2 |
Samba is a suite of SMB and CIFS client/server programs for UNIX.
Samba contains a logical error in the smbd daemon when translating local SID to user names (CVE-2007-2444). Furthermore, Samba contains several bugs when parsing NDR encoded RPC parameters (CVE-2007-2446). Lastly, Samba fails to properly sanitize remote procedure input provided via Microsoft Remote Procedure Calls (CVE-2007-2447).
A remote attacker could exploit these vulnerabilities to gain root privileges via various vectors.
There is no known workaround at this time.
All Samba users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-fs/samba-3.0.24-r2"
Multiple flaws exist in the Samba suite of programs, the most serious of which could result in the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-fs/samba | * | < 3.0.24 | >= 3.0.24 |
Samba is a suite of SMB and CIFS client/server programs for UNIX.
A format string vulnerability exists in the VFS module when handling AFS file systems and an infinite loop has been discovered when handling file rename operations.
A user with permission to write to a shared AFS file system may be able to compromise the smbd process and execute arbitrary code with the permissions of the daemon. The infinite loop could be abused to consume excessive resources on the smbd host, denying service to legitimate users.
There is no known workaround at this time.
All Samba users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-fs/samba-3.0.24"
A large number of share connection requests could cause a Denial of Service within Samba.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-fs/samba | * | < 3.0.22-r3 | >= 3.0.22-r3 |
Samba is a freely available SMB/CIFS implementation which allows seamless interoperability of file and print services to other SMB/CIFS clients.
During an internal audit the Samba team discovered that a flaw in the way Samba stores share connection requests could lead to a Denial of Service.
By sending a large amount of share connection requests to a vulnerable Samba server, an attacker could cause a Denial of Service due to memory consumption.
There is no known workaround at this time.
All Samba users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-fs/samba-3.0.22-r3"
Samba contains a bug that could lead to remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-fs/samba | * | <= 3.0.9 | >= 3.0.9-r1 |
Samba is a freely available SMB/CIFS implementation which allows seamless interoperability of file and print services to other SMB/CIFS clients.
Samba contains a bug when unmarshalling specific MS-RPC requests from clients.
A remote attacker may be able to execute arbitrary code with the permissions of the user running Samba, which could be the root user.
There is no known workaround at this time.
All samba users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-fs/samba-3.0.9-r1"
Samba is vulnerable to a buffer overflow that could lead to execution of arbitrary code (CAN-2004-0882). Another flaw in Samba may allow a remote attacker to cause a Denial of Service by excessive consumption of CPU cycles (CAN-2004-0930).
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-fs/samba | * | < 3.0.8 | >= 3.0.8, < 3.0 |
Samba is a freely available SMB/CIFS implementation which allows seamless interoperability of file and print services to other SMB/CIFS clients.
Samba fails to do proper bounds checking when handling TRANSACT2_QFILEPATHINFO replies. Additionally an input validation flaw exists in ms_fnmatch.c when matching filenames that contain wildcards.
An attacker may be able to execute arbitrary code with the permissions of the user running Samba. A remote attacker may also be able to cause an abnormal consumption of CPU resources, resulting in slower performance of the server or even a Denial of Service.
There is no known workaround at this time.
All Samba users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-fs/samba-3.0.8"
Two Denial of Service vulnerabilities have been found and fixed in Samba.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-fs/samba | * | < 3.0.7 | >= 3.0.7, < 3.0 |
Samba is a freely available SMB/CIFS implementation which allows seamless interoperability of file and print services to other SMB/CIFS clients. smbd and nmbd are two daemons used by the Samba server.
There is a defect in smbd's ASN.1 parsing. A bad packet received during the authentication request could throw newly-spawned smbd processes into an infinite loop (CAN-2004-0807). Another defect was found in nmbd's processing of mailslot packets, where a bad NetBIOS request could crash the nmbd process (CAN-2004-0808).
A remote attacker could send specially crafted packets to trigger both defects. The ASN.1 parsing issue can be exploited to exhaust all available memory on the Samba host, potentially denying all service to that server. The nmbd issue can be exploited to crash the nmbd process, resulting in a Denial of Service condition on the Samba server.
There is no known workaround at this time.
All Samba 3.x users should upgrade to the latest version:
# emerge sync # emerge -pv ">=net-fs/samba-3.0.7" # emerge ">=net-fs/samba-3.0.7"
Two buffer overflows vulnerabilities were found in Samba, potentially allowing the remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-fs/samba | * | <= 3.0.4-r1 | >= 3.0.5 |
Samba is a package which allows *nix systems to act as file servers for Windows computers. It also allows *nix systems to mount shares exported by a Samba/CIFS/Windows server. The Samba Web Administration Tool (SWAT) is a web-based configuration tool part of the Samba package.
Evgeny Demidov found a buffer overflow in SWAT, located in the base64 data decoder used to handle HTTP basic authentication (CAN-2004-0600). The same flaw is present in the code used to handle the sambaMungedDial attribute value, when using the ldapsam passdb backend. Another buffer overflow was found in the code used to support the 'mangling method = hash' smb.conf option (CAN-2004-0686). Note that the default Samba value for this option is 'mangling method = hash2' which is not vulnerable.
The SWAT authentication overflow could be exploited to execute arbitrary code with the rights of the Samba daemon process. The overflow in the sambaMungedDial handling code is not thought to be exploitable. The buffer overflow in 'mangling method = hash' code could also be used to execute arbitrary code on vulnerable configurations.
Users disabling SWAT, not using ldapsam passdb backends and not using the 'mangling method = hash' option are not vulnerable.
All Samba users should upgrade to the latest version:
# emerge sync # emerge -pv ">=net-fs/samba-3.0.5" # emerge ">=net-fs/samba-3.0.5"
There is a bug in smbfs which may allow local users to gain root via a setuid file on a mounted Samba share. Also, there is a tmpfile symlink vulnerability in the smbprint script distributed with Samba.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-fs/samba | * | <= 3.0.2a | >= 3.0.2a-r2 |
Samba is a package which allows UNIX systems to act as file servers for Windows computers. It also allows UNIX systems to mount shares exported by a Samba/CIFS/Windows server. smbmount is a program in the Samba package which allows normal users on a UNIX system to mount remote shares. smbprint is an example script included in the Samba package which can be used to facilitate network printing.
Two vulnerabilities have been discovered in Samba. The first vulnerability allows a local user who has access to the smbmount command to gain root. An attacker could place a setuid-root binary on a Samba share/server he or she controls, and then use the smbmount command to mount the share on the target UNIX box. The remote Samba server must support UNIX extensions for this to work. This has been fixed in version 3.0.2a.
The second vulnerability is in the smbprint script. By creating a symlink from /tmp/smbprint.log, an attacker could cause the smbprint script to write to an arbitrary file on the system. This has been fixed in version 3.0.2a-r2.
Local users with access to the smbmount command may gain root access. Also, arbitrary files may be overwritten using the smbprint script.
To workaround the setuid bug, remove the setuid bits from the /usr/bin/smbmnt, /usr/bin/smbumount and /usr/bin/mount.cifs binaries. However, please note that this workaround will prevent ordinary users from mounting remote SMB and CIFS shares.
To work around the smbprint vulnerability, set "debug=no" in the smbprint configuration.
All users should update to the latest version of the Samba package.
The following commands will perform the upgrade:
# emerge sync # emerge -pv ">=net-fs/samba-3.0.2a-r2" # emerge ">=net-fs/samba-3.0.2a-r2"
Those who are using Samba's password database also need to run the following command:
# pdbedit --force-initialized-passwords
Those using LDAP for Samba passwords also need to check the sambaPwdLastSet attribute on each account, and ensure it is not 0.