Joined: 12 May 2004
|Posted: Sat Mar 07, 2009 7:26 pm Post subject: [ GLSA 200903-07 ] Samba: Data disclosure
|Gentoo Linux Security Advisory
Title: Samba: Data disclosure (GLSA 200903-07)
Date: March 07, 2009
A missing boundary check in Samba might lead to the disclosure of memory contents.
Samba is a suite of SMB and CIFS client/server programs.
Vulnerable: < 3.0.33
Unaffected: >= 3.0.33
Architectures: All supported architectures
Samba does not properly check memory boundaries when handling trans, rans2, and nttrans requests.
A remote attacker could send specially crafted requests to a Samba daemon, leading to the disclosure of arbitrary memory or to a Denial of Service.
There is no known workaround at this time.
All Samba users should upgrade to the latest version:
|# emerge --sync
# emerge --ask --oneshot --verbose ">=net-fs/samba-3.0.33"