Samba allows file access outside of the share`s defined path
| samba-file-access (17556) |  Medium Risk |
Description:
Samba could allow a remote attacker to gain unauthorized access to files outside of the share's defined path, caused by a vulnerability in DOS pathname conversion routines.
Platforms Affected:
- Conectiva, Linux 10
- Conectiva, Linux 9.0
- Debian, Debian Linux 3.0
- HP, HP-UX 11.00
- HP, HP-UX 11.11
- HP, HP-UX 11.22
- HP, HP-UX 11.23
- MandrakeSoft, Mandrake Linux 9.2
- MandrakeSoft, Mandrake Linux 9.2 AMD64
- MandrakeSoft, Mandrake Linux Corporate Server 2.1 X86_64
- MandrakeSoft, Mandrake Linux Corporate Server 2.1
- RedHat, Enterprise Linux 2.1 WS
- RedHat, Enterprise Linux 2.1 AS
- RedHat, Enterprise Linux 2.1 ES
- RedHat, Linux Advanced Workstation 2.1 Itanium
- Samba, Samba 2.2.0
- Samba, Samba 2.2.0a
- Samba, Samba 2.2.11
- Samba, Samba 2.2.1a
- Samba, Samba 2.2.2
- Samba, Samba 2.2.3
- Samba, Samba 2.2.3a
- Samba, Samba 2.2.4
- Samba, Samba 2.2.5
- Samba, Samba 2.2.6
- Samba, Samba 2.2.7
- Samba, Samba 2.2.7a
- Samba, Samba 2.2.8
- Samba, Samba 2.2.8a
- Samba, Samba 2.2.9
- Samba, Samba 2.2a
- Samba, Samba 3.0 Alpha
- Samba, Samba 3.0.0
- Samba, Samba 3.0.1
- Samba, Samba 3.0.2
- Samba, Samba 3.0.2a
- Sun, JDS 2003
- Sun, JDS Release 2
- SuSE, Linux Enterprise Server 8
- SuSE, SuSE Linux 8.1
- SuSE, SuSE Linux 8.2
- SuSE, SuSE Linux 9.0
- SuSE, SuSE Linux Desktop 1.0
- Trustix, Secure Linux 1.5
- Trustix, Secure Linux 2.0
Remedy:
For Samba 2.2.x:
Upgrade to the latest version of Samba (2.2.12 or later), as listed in Samba Security Announcement 30 September 2004. See References.
For Samba 3.0.5 and earlier:
Apply the 3.0.5-reduce_name.patch, as listed in Samba Security Announcement 30 September 2004. See References.
For Trustix Secure Linux:
Upgrade to the latest samba package, as listed below. Refer to Trustix Secure Linux Security Advisory #2004-0051 for more information. See References.
Trustix Secure Linux 1.5: 2.2.12-0.1tr or later
Trustix Secure Linux 2.0: 2.2.12-1tr or later
For SuSE Linux:
Upgrade to the latest samba package, as listed below. Refer to SuSE Security Announcement SUSE-SA:2004:035 for more information. See References.
SuSE Linux 9.0: 2.2.8a-226 or later
SuSE Linux 8.2: 2.2.8a-225 or later
SuSE Linux 8.1: 2.2.8a-224 or later
x86 platform:
SuSE Linux 9.0: 2.2.8a-226.x86_64 or later
For Debian GNU/Linux 3.0 (woody):
Upgrade to the latest samba package, as listed below. Refer to DSA-600-1 for more information. See References.
Debian GNU/Linux 3.0 (woody): 2.2.3a-14.1 or later
For Conectiva Linux:
Upgrade to the latest samba package, as listed below. Refer to Conectiva Linux Security Announcement CLSA-2004:873 for more information. See References.
Conectiva Linux 10: 3.0.7-62749U10_4cl or later
Conectiva Linux 9: 2.2.12-27520U90_1cl or later
For HP-UX 11.00, 11.11, 11.22, and 11.23:
Apply the appropriate Patches for your system, as listed in Hewlett-Packard Company Security Bulletin: HPSBUX01086. See References.
For Sun Java Desktop System (JDS):
Apply the appropriate patch for your system, as listed below. Refer to Sun Alert ID: 57694 for more information. See References.
Linux Platform:
Sun Java Desktop System (JDS) 2003 and Release 2: patch-9397 or later
For other distributions:
Contact your vendor for upgrade or patch information.
Consequences:
Gain Access
References:
- BugTraq Mailing List, Tue Oct 05 2004 - 15:34:21 CDT, ERRATA: Potential Arbitrary File Access (CAN-2004-0815) at http://archives.neohapsis.com/archives/bugtraq/2004-10/0038.html.
- CIAC Information Bulletin P-044, Arbitrary File Access Vulnerability at http://www.ciac.org/ciac/bulletins/p-044.shtml.
- Conectiva Linux Security Announcement CLSA-2004:873, Fix for samba vulnerabilities at http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=000873.
- Samba Security Announcement 30 September 2004, Security Notice -- CVE CAN-2004-0815 at http://us4.samba.org/samba/news/#security_2.2.12.
- Sun Alert ID: 57694, Security Vulnerability When Samba Trims Certain Directory Names Down to Absolute Paths at http://sunsolve.sun.com/search/document.do?assetkey=1-26-57694-1&searchclause=%22category:security%22%20%22availability,%20security%22.
- Trustix Secure Linux Security Advisory #2004-0051, access files outside of defined path at http://www.linuxsecurity.com/content/view/106572/109/.
- BID-11281: Samba Remote Arbitrary File Access Vulnerability
- CVE-2004-0815: The unix_clean_name function in Samba 2.2.x through 2.2.11, and 3.0.x before 3.0.2a, trims certain directory names down to absolute paths, which could allow remote attackers to bypass the specified share restrictions and read, write, or list arbitrary files via /.//// style sequences in pathnames.
- DSA-600: samba -- arbitrary file access
- MDKSA-2004:104: Updated samba packages fix vulnerability
- RHSA-2004-498: samba security update
- SUSE-SA:2004:035: samba: remote file disclosure
Reported:
Sep 30, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net