Debian Security Advisory

Samba -- Security problems corrected in new upstream version

Date Reported:
31 Jul 1999
Affected Packages:
samba
samba-common
smbclient
smbfs
smbwrapper
swat
Vulnerable:
Yes
Security database references:
In Mitre's CVE dictionary: CVE-1999-0810, CVE-1999-0811, CVE-1999-0812.
More information:
The version of samba as distributed in Debian GNU/Linux 2.1 has a couple of security problems:
  • a Denial-of-Service attack against nmbd was possible
  • it was possible to exploit smbd if you had a message command defined which used the %f or %M formatter.
  • smbmnt's check to see if a user is allowed to create a mount was flawed which allowed users to mount at arbitrary mount points in the file system.

These problems have been fixed in version 2.0.5a-1. We recommend you upgrade your samba packages immediately.

Please note that this is a major upgrade so please be careful when you upgrade since some changes to the configuration file might be necessary. The configuration file also moved to a new location (/etc/samba).

The smbfsx package is also obsolete with this update and has been replaced by smbfs, which can handle both 2.0 and 2.2 kernels now.

Fixed in:
Architecture-independent component:
http://security.debian.org/dists/stable/updates/binary-all/samba-doc_2.0.5a-1_all.deb
alpha:
http://security.debian.org/dists/stable/updates/binary-alpha/samba-common_2.0.5a-1_alpha.deb
http://security.debian.org/dists/stable/updates/binary-alpha/samba_2.0.5a-1_alpha.deb
http://security.debian.org/dists/stable/updates/binary-alpha/smbclient_2.0.5a-1_alpha.deb
http://security.debian.org/dists/stable/updates/binary-alpha/smbfs_2.0.5a-1_alpha.deb
http://security.debian.org/dists/stable/updates/binary-alpha/smbwrapper_2.0.5a-1_alpha.deb
http://security.debian.org/dists/stable/updates/binary-alpha/swat_2.0.5a-1_alpha.deb
i386:
http://security.debian.org/dists/stable/updates/binary-i386/samba-common_2.0.5a-1_i386.deb
http://security.debian.org/dists/stable/updates/binary-i386/samba_2.0.5a-1_i386.deb
http://security.debian.org/dists/stable/updates/binary-i386/smbclient_2.0.5a-1_i386.deb
http://security.debian.org/dists/stable/updates/binary-i386/smbfs_2.0.5a-1_i386.deb
http://security.debian.org/dists/stable/updates/binary-i386/smbwrapper_2.0.5a-1_i386.deb
http://security.debian.org/dists/stable/updates/binary-i386/swat_2.0.5a-1_i386.deb
m68k:
http://security.debian.org/dists/stable/updates/binary-m68k/samba-common_2.0.5a-1_m68k.deb
http://security.debian.org/dists/stable/updates/binary-m68k/samba_2.0.5a-1_m68k.deb
http://security.debian.org/dists/stable/updates/binary-m68k/smbclient_2.0.5a-1_m68k.deb
http://security.debian.org/dists/stable/updates/binary-m68k/smbfs_2.0.5a-1_m68k.deb
http://security.debian.org/dists/stable/updates/binary-m68k/smbwrapper_2.0.5a-1_m68k.deb
http://security.debian.org/dists/stable/updates/binary-m68k/swat_2.0.5a-1_m68k.deb
sparc:
http://security.debian.org/dists/stable/updates/binary-sparc/samba-common_2.0.5a-1_sparc.deb
http://security.debian.org/dists/stable/updates/binary-sparc/samba_2.0.5a-1_sparc.deb
http://security.debian.org/dists/stable/updates/binary-sparc/smbclient_2.0.5a-1_sparc.deb
http://security.debian.org/dists/stable/updates/binary-sparc/smbfs_2.0.5a-1_sparc.deb
http://security.debian.org/dists/stable/updates/binary-sparc/smbwrapper_2.0.5a-1_sparc.deb
http://security.debian.org/dists/stable/updates/binary-sparc/swat_2.0.5a-1_sparc.deb