Bug 86209 - Security issue in samba - remote anonymous root
Summary: Security issue in samba - remote anonymous root
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Linux
Classification: Retired
Component: samba
Version: 8.0
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Jay Fenlason
QA Contact: David Lawrence
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2003-03-17 10:00 UTC by Mark J. Cox
Modified: 2014-08-31 23:24 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2003-03-19 09:31:51 UTC

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Description Mark J. Cox 2003-03-17 10:00:02 UTC 
Sebastian Krahmer discovered a security vulnerability present
in unpatched versions of Samba prior to 2.2.8. An anonymous user could use
the vulnerability to gain root access on the target machine.
This is CAN-2003-0085

Additionally, a race condition could allow an attacker to overwrite
critical system files.
This is CAN-2003-0086

Updated packages for Red Hat Linux 6.2, 7, 7.1, 7.2, 7.3 and 8.0 will be
available shortly at RHSA-2003:095

http://www.samba.org/samba/whatsnew/samba-2.2.8.html
Comment 1 Mark J. Cox 2003-03-19 09:31:51 UTC 
This is fixed in http://rhn.redhat.com/errata/RHSA-2003-095.html for Red Hat
Linux 7.2, 7.3, and 8.0.  An advisory for Red Hat Linux 6.2, 7, 7.1 will be
available shortly.
Note You need to log in before you can comment on or make changes to this bug.