ERRATA: Potential Arbitrary File Access (CAN-2004-0815)

2004-10-06T00:00:00
ID SECURITYVULNS:DOC:6931
Type securityvulns
Reporter Securityvulns
Modified 2004-10-06T00:00:00

Description

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

ERRATA


The original announcement for the Samba vulnerability identified by CAN-2004-0815 reported that Samba versions 3.0.0 - 3.0.5 inclusive were subject the remote file access bug. Later research has confirmed that only Samba 3.0.x <= 3.0.2a contains the exploitable code.

The Samba Team expresses sincere apologies for any confusion this inaccuracy in the original announcement has caused.

Updated Security Announcement


Subject: Potential Arbitrary File Access

Affected Versions: Samba 2.2.x <= 2.2.11 and Samba 3.0.x <= 3.0.2a

Summary: A remote attacker may be able to gain access to files which exist outside of the share's defined path. Such files must still be readable by the account used for the connection.

Patch Availability


The patch for Samba 3.0.2a and earlier releases 3.0.x (samba-3.0.2a-reduce_name.patch) can be downloaded from http://download.samba.org/samba/ftp/patches/security/

Samba 2.2.12 has been released to specifically address this bug.

Description


A bug in the input validation routines used to convert DOS path names to path names on the Samba host's file system may be exploited to gain access to files outside of the share's path defined by smb.conf.

Protecting Unpatched Servers


Samba file shares with 'wide links = no' (a non-default setting) in the service definition in smb.conf are not vulnerable to this attack.

The Samba Team always encourages users to run the latest stable release as a defense of against attacks. However, under certain circumstances it may not be possible to immediately upgrade important installations. In such cases, administrators should read the "Server Security" documentation found at http://www.samba.org/samba/docs/server_security.html.

Credits


Both security issues were reported to Samba developers by iDEFENSE (http://www.idefense.com/). Karol Wiesek is credited with this discovery.


Please report any security related issues to <security@samba.org> Our Code, Our Bugs, Our Responsibility.

                            -- The Samba Team

-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFBYwVNIR7qMdg1EfYRArV5AJ9JolpzgMkl9ho0E0qX63ioUphp5gCgvHyo S5v6X9AGLlV3+Bp4nsNh+1w= =G9uZ -----END PGP SIGNATURE-----