[SECURITY] [DSA 2463-1] samba security update

2012-05-0215:33:03

lists.debian.org

6.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

0.004 Low

EPSS

Percentile

73.0%

JSON

Debian Security Advisory DSA-2463-1 [email protected]
http://www.debian.org/security/ Moritz Muehlenhoff
May 02, 2012 http://www.debian.org/security/faq

Package : samba
Vulnerability : missing permission checks
Problem type : remote
Debian-specific: no
CVE ID : CVE-2012-2111

Ivano Cristofolini discovered that insufficient security checks in
Samba's handling of LSA RPC calls could lead to privilege escalation
by gaining the "take ownership" privilege.

For the stable distribution (squeeze), this problem has been fixed in
version 3.5.6~dfsg-3squeeze8.

For the unstable distribution (sid), this problem has been fixed in
version 3.6.5-1.

We recommend that you upgrade your samba packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian6sparclibpam-smbpass< 2:3.5.6~dfsg-3squeeze8libpam-smbpass_2:3.5.6~dfsg-3squeeze8_sparc.deb
Debian6kfreebsd-i386libsmbclient< 2:3.5.6~dfsg-3squeeze8libsmbclient_2:3.5.6~dfsg-3squeeze8_kfreebsd-i386.deb
Debian6mipssamba< 2:3.5.6~dfsg-3squeeze8samba_2:3.5.6~dfsg-3squeeze8_mips.deb
Debian6kfreebsd-amd64samba-common-bin< 2:3.5.6~dfsg-3squeeze8samba-common-bin_2:3.5.6~dfsg-3squeeze8_kfreebsd-amd64.deb
Debian6powerpcswat< 2:3.5.6~dfsg-3squeeze8swat_2:3.5.6~dfsg-3squeeze8_powerpc.deb
Debian6i386libwbclient0< 2:3.5.6~dfsg-3squeeze8libwbclient0_2:3.5.6~dfsg-3squeeze8_i386.deb
Debian6ia64smbclient< 2:3.5.6~dfsg-3squeeze8smbclient_2:3.5.6~dfsg-3squeeze8_ia64.deb
Debian6i386samba-dbg< 2:3.5.6~dfsg-3squeeze8samba-dbg_2:3.5.6~dfsg-3squeeze8_i386.deb
Debian6armelsamba< 2:3.5.6~dfsg-3squeeze8samba_2:3.5.6~dfsg-3squeeze8_armel.deb
Debian6amd64libsmbclient< 2:3.5.6~dfsg-3squeeze8libsmbclient_2:3.5.6~dfsg-3squeeze8_amd64.deb

OS	Version	Architecture	Package	Version	Filename
Debian	6	sparc	libpam-smbpass	< 2:3.5.6~dfsg-3squeeze8	libpam-smbpass_2:3.5.6~dfsg-3squeeze8_sparc.deb
Debian	6	kfreebsd-i386	libsmbclient	< 2:3.5.6~dfsg-3squeeze8	libsmbclient_2:3.5.6~dfsg-3squeeze8_kfreebsd-i386.deb
Debian	6	mips	samba	< 2:3.5.6~dfsg-3squeeze8	samba_2:3.5.6~dfsg-3squeeze8_mips.deb
Debian	6	kfreebsd-amd64	samba-common-bin	< 2:3.5.6~dfsg-3squeeze8	samba-common-bin_2:3.5.6~dfsg-3squeeze8_kfreebsd-amd64.deb
Debian	6	powerpc	swat	< 2:3.5.6~dfsg-3squeeze8	swat_2:3.5.6~dfsg-3squeeze8_powerpc.deb
Debian	6	i386	libwbclient0	< 2:3.5.6~dfsg-3squeeze8	libwbclient0_2:3.5.6~dfsg-3squeeze8_i386.deb
Debian	6	ia64	smbclient	< 2:3.5.6~dfsg-3squeeze8	smbclient_2:3.5.6~dfsg-3squeeze8_ia64.deb
Debian	6	i386	samba-dbg	< 2:3.5.6~dfsg-3squeeze8	samba-dbg_2:3.5.6~dfsg-3squeeze8_i386.deb
Debian	6	armel	samba	< 2:3.5.6~dfsg-3squeeze8	samba_2:3.5.6~dfsg-3squeeze8_armel.deb
Debian	6	amd64	libsmbclient	< 2:3.5.6~dfsg-3squeeze8	libsmbclient_2:3.5.6~dfsg-3squeeze8_amd64.deb