[Please upgrade samba on all platforms. This is not the same as the
vulnerabilities reported last month -- Raju]
This is an RFC 1153 digest.
(1 message)
----------------------------------------------------------------------
Message-ID: <[EMAIL PROTECTED]>
From: "Gerald (Jerry) Carter" <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Cc: [EMAIL PROTECTED], [EMAIL PROTECTED]
Subject: [SECURITY] CAN-2004-0930: Potential Remote Denial of Service
Vulnerability
in Samba 3.0.x <= 3.0.7
Date: Mon, 08 Nov 2004 11:45:02 -0600
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Subject: Potential Remote Denial of Service
CVE #: CAN-2004-0930
Affected
Versions: Samba 3.0.x <= 3.0.7
Summary: A remote attacker could cause and smbd process
to consume abnormal amounts of system resources
due to an input validation error when matching
filenames containing wildcard characters.
Patch Availability
- ------------------
A patch for Samba 3.0.7 (samba-3.0.7-CAN-2004-0930.patch) is
available from http://www.samba.org/samba/ftp/patches/security/.
The patch has been signed with the "Samba Distribution Verification
Key" (ID F17F9772).
Description
- -----------
A bug in the input validation routines used to match
filename strings containing wildcard characters may allow
a user to consume more than normal amounts of CPU cycles
thus impacting the performance and response of the server.
In some circumstances the server can become entirely
unresponsive.
Protecting Unpatched Servers
- ----------------------------
The Samba Team always encourages users to run the latest stable
release as a defense of against attacks. However, under certain
circumstances it may not be possible to immediately upgrade
important installations. In such cases, administrators should
read the "Server Security" documentation found at
http://www.samba.org/samba/docs/server_security.html.
Credits
- --------
This security issue was reported to Samba developers by
iDEFENSE (http://www.idefense.com/). Karol Wiesek is credited
with this discovery.
- --
Our Code, Our Bugs, Our Responsibility.
-- The Samba Team
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iD8DBQFBj7CeIR7qMdg1EfYRAj+MAKDNkcUR/2ty7ImGmQQgMyJmJL2PXwCgguGr
bT7+yChNg9Sg++7fdexNg9g=
=WfWT
-----END PGP SIGNATURE-----
------------------------------
End of this Digest
******************
--
Raj Mathur [EMAIL PROTECTED] http://kandalaya.org/
GPG: 78D4 FC67 367F 40E2 0DD5 0FEF C968 D0EF CC68 D17F
It is the mind that moves
-------------------------------------------------------
This SF.Net email is sponsored by:
Sybase ASE Linux Express Edition - download now for FREE
LinuxWorld Reader's Choice Award Winner for best database on Linux.
http://ads.osdn.com/?ad_id=5588&alloc_id=12065&op=click
_______________________________________________
linux-india-help mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/linux-india-help
