Bug#568493: [Pkg-samba-maint] Bug#568493: samba: zero-day remote access exploit

2010-02-06 Thread Christian PERRIER
Quoting Michael Gilbert (michael.s.gilb...@gmail.com): no, if you watch the video closely (also see [0]), you can see that they have read access to pretty much any file on the system (i.e. /etc/passwd) and write access to any location writable by the account they connect under. That's a

Bug#568493: [Pkg-samba-maint] Bug#568493: samba: zero-day remote access exploit

2010-02-06 Thread Michael Gilbert
On Sat, 6 Feb 2010 12:14:58 +0100 Christian PERRIER wrote: Quoting Michael Gilbert (michael.s.gilb...@gmail.com): no, if you watch the video closely (also see [0]), you can see that they have read access to pretty much any file on the system (i.e. /etc/passwd) and write access to any

Bug#568493: [Pkg-samba-maint] Bug#568493: Bug#568493: samba: zero-day remote access exploit

2010-02-06 Thread Christian PERRIER
Quoting Michael Gilbert (michael.s.gilb...@gmail.com): if i see an active exploit on one of the lists i'm following, then i am going to report it (after all, does't Debian does not hide problems?); Not hiding problems is not reproducing all bug reported upstream in our BTS. Apart from bringing

Bug#568493: [Pkg-samba-maint] Bug#568493: Bug#568493: samba: zero-day remote access exploit

2010-02-06 Thread Michael Gilbert
On Sat, 6 Feb 2010 16:50:44 +0100 Christian PERRIER wrote: Quoting Michael Gilbert (michael.s.gilb...@gmail.com): if i see an active exploit on one of the lists i'm following, then i am going to report it (after all, does't Debian does not hide problems?); Not hiding problems is not

Bug#568493: [Pkg-samba-maint] Bug#568493: Bug#568493: samba: zero-day remote access exploit

2010-02-06 Thread Julien Cristau
On Sat, Feb 6, 2010 at 10:39:54 -0500, Michael Gilbert wrote: sorry if this seems rude, but i'm tired of getting snippy emails. You'd get less snippy emails if you got off your high horse. Cheers, Julien signature.asc Description: Digital signature

Bug#568493: [Pkg-samba-maint] Bug#568493: Bug#568493: samba: zero-day remote access exploit

2010-02-06 Thread Michael Gilbert
On Sat, 6 Feb 2010 17:14:34 +0100 Julien Cristau wrote: On Sat, Feb 6, 2010 at 10:39:54 -0500, Michael Gilbert wrote: sorry if this seems rude, but i'm tired of getting snippy emails. You'd get less snippy emails if you got off your high horse. thanks for another one! have you ever

Bug#568493: [Pkg-samba-maint] Bug#568493: Bug#568493: Bug#568493: samba: zero-day remote access exploit

2010-02-06 Thread Christian PERRIER
Quoting Julien Cristau (jcris...@debian.org): You'd get less snippy emails if you got off your high horse. I'm not sure Michael deserves being bashed this way. We disagree in some way on the course of actions, but he has always been respectful for our work as maintainers. I suggest we all cool

Bug#568493: samba: zero-day remote access exploit

2010-02-05 Thread Steve Langasek
severity 568493 important thanks On Fri, Feb 05, 2010 at 01:07:14AM -0500, Michael Gilbert wrote: package: samba version: 2:3.4.5~dfsg-1 severity: critical hi, a zero-day remote access exploit has been demonstrated using a vulnerability in samba [0]. the only info to go on right now is a

Bug#568493: samba: zero-day remote access exploit

2010-02-05 Thread Michael Gilbert
On Thu, 4 Feb 2010 23:18:18 -0800, Steve Langasek wrote: severity 568493 important thanks On Fri, Feb 05, 2010 at 01:07:14AM -0500, Michael Gilbert wrote: package: samba version: 2:3.4.5~dfsg-1 severity: critical hi, a zero-day remote access exploit has been demonstrated using a

Bug#568493: samba: zero-day remote access exploit

2010-02-04 Thread Michael Gilbert
package: samba version: 2:3.4.5~dfsg-1 severity: critical hi, a zero-day remote access exploit has been demonstrated using a vulnerability in samba [0]. the only info to go on right now is a rather blurry video demonstrating the exploit in action as well as the code modified. i know this isn't a

Bug#568493: samba: zero-day remote access exploit

2010-02-04 Thread Michael Gilbert
note that it looks to be exposed only for public shares that are writable, which should be an uncommon configuration for security-conscious users. mike -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact