Le Mardi 3 Juin 2003 19:32, vous avez écrit : > Le Mardi 3 Juin 2003 11:02, xavier benigni a écrit : > > a propos, faite gaffe a samba<3.x, sambal l'attaque tres facilement et si > > le bug est corrige dans la version 3, alors les fichiers de conf de la > > version 2 sont mal compatibles ... > > tu as plus d'info la dessus (lien...) ? > CC CERT-Renater : 2003/VULN207 (Sun: Security Vulnerability in Samba(7) versions 2.2.2 through 2.2.8 May Allow Remote User Unauthorized Privileges)
De : CERT Renater <[EMAIL PROTECTED]> (GIP-RENATER) À : [EMAIL PROTECTED] Date : Hier 12:34:35 ===================================================================== CERT-Renater Note d'Information No. 2003/VULN207 _____________________________________________________________________ DATE : 03/06/2003 HARDWARE PLATFORM(S) : / OPERATING SYSTEM(S) : Systems running Samba versions prior to 2.2.8a or Samba-TNG versions prior to 0.3.2 ====================================================================== Sun(sm) Alert Notification Sun Alert ID: 53581 Synopsis: Security Vulnerability in Samba(7) versions 2.2.2 through 2.2.8 May Allow Remote User Unauthorized Privileges Category: Security Product: Solaris BugIDs: 4833908 Avoidance: Workaround, Patch State: Resolved Date Released: 18-Apr-2003, 28-May-2003 Date Closed: 28-May-2003 Date Modified: 28-May-2003 1. Impact Several buffer overflows have been found in Samba(7), at least one of which may allow a remote unprivileged user to execute arbitrary code with the privileges of the Super User (typically root), on a Solaris 9 system running as a Samba(7) server. This issue is described in CERT Vulnerability Notes VU#298233 (see http://www.kb.cert.org/vuls/id/298233) and VU#267873 (see http://www.kb.cert.org/vuls/id/267873). 2. Contributing Factors .... Only systems configured as Samba servers running Samba versions 2.0.x through 2.2.8 are vulnerable to this issue. To determine if a system is configured as a Samba server the following command can be run: % ls -l /etc/sfw/smb.conf To determine the version of Samba installed, the following command can be run: % smbd -V ... 3. Symptoms There are no predictable symptoms that would show the described issue has been exploited to gain root privileges. Solution Summary Top 4. Relief/Workaround Workaround information can be found in the "Protecting an unpatched Samba server" section from the Samba Team announcement for version 2.2.8 at: http://www.samba.org/samba/whatsnew/samba-2.2.8.html. ... ====================================================================== ========================================================= Les serveurs de référence du CERT-Renater http://www.urec.fr/securite http://www.cru.fr/securite http://www.renater.fr ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 151 bd de l'Hopital | fax : 01-53-94-20-41 + + 75013 Paris | email: [EMAIL PROTECTED] + =========================================================
Vous souhaitez acquerir votre Pack ou des Services MandrakeSoft? Rendez-vous sur "http://www.mandrakestore.com"