Samba allows file access outside of the share`s defined path
| samba-file-access (17556) |  Medium Risk |
Description:
Samba could allow a remote attacker to gain unauthorized access to files outside of the share's defined path, caused by a vulnerability in DOS pathname conversion routines.
Consequences:
Gain Access
Remedy:
For Samba 2.2.x:
Upgrade to the latest version of Samba (2.2.12 or later), as listed in Samba Security Announcement 30 September 2004. See References.
For Samba 3.0.5 and earlier:
Apply the 3.0.5-reduce_name.patch, as listed in Samba Security Announcement 30 September 2004. See References.
For Trustix Secure Linux:
Upgrade to the latest samba package, as listed below. Refer to Trustix Secure Linux Security Advisory #2004-0051 for more information. See References.
Trustix Secure Linux 1.5: 2.2.12-0.1tr or later
Trustix Secure Linux 2.0: 2.2.12-1tr or later
For SuSE Linux:
Upgrade to the latest samba package, as listed below. Refer to SuSE Security Announcement SUSE-SA:2004:035 for more information. See References.
SuSE Linux 9.0: 2.2.8a-226 or later
SuSE Linux 8.2: 2.2.8a-225 or later
SuSE Linux 8.1: 2.2.8a-224 or later
x86 platform:
SuSE Linux 9.0: 2.2.8a-226.x86_64 or later
For Debian GNU/Linux 3.0 (woody):
Upgrade to the latest samba package, as listed below. Refer to DSA-600-1 for more information. See References.
Debian GNU/Linux 3.0 (woody): 2.2.3a-14.1 or later
For Conectiva Linux:
Upgrade to the latest samba package, as listed below. Refer to Conectiva Linux Security Announcement CLSA-2004:873 for more information. See References.
Conectiva Linux 10: 3.0.7-62749U10_4cl or later
Conectiva Linux 9: 2.2.12-27520U90_1cl or later
For HP-UX 11.00, 11.11, 11.22, and 11.23:
Apply the appropriate Patches for your system, as listed in Hewlett-Packard Company Security Bulletin: HPSBUX01086. See References.
For Sun Java Desktop System (JDS):
Apply the appropriate patch for your system, as listed below. Refer to Sun Alert ID: 57694 for more information. See References.
Linux Platform:
Sun Java Desktop System (JDS) 2003 and Release 2: patch-9397 or later
For other distributions:
Contact your vendor for upgrade or patch information.
References:
- BugTraq Mailing List, Tue Oct 05 2004 - 15:34:21 CDT: ERRATA: Potential Arbitrary File Access (CAN-2004-0815).
- CIAC Information Bulletin P-044: Arbitrary File Access Vulnerability.
- Conectiva Linux Security Announcement CLSA-2004:873: Fix for samba vulnerabilities.
- Samba Security Announcement 30 September 2004: Security Notice -- CVE CAN-2004-0815.
- Sun Alert ID: 57694: Security Vulnerability When Samba Trims Certain Directory Names Down to Absolute Paths.
- Trustix Secure Linux Security Advisory #2004-0051: access files outside of defined path.
- BID-11281: Samba Remote Arbitrary File Access Vulnerability
- CVE-2004-0815: The unix_clean_name function in Samba 2.2.x through 2.2.11, and 3.0.x before 3.0.2a, trims certain directory names down to absolute paths, which could allow remote attackers to bypass the specified share restrictions and read, write, or list arbitrary files via /.//// style sequences in pathnames.
- DSA-600: samba -- arbitrary file access
- MDKSA-2004:104: Updated samba packages fix vulnerability
- RHSA-2004-498: samba security update
- SUSE-SA:2004:035: samba: remote file disclosure
Platforms Affected:
- Conectiva Linux 10
- Conectiva Linux 9.0
- Debian Debian Linux 3.0
- HP HP-UX 11.00
- HP HP-UX 11.11
- HP HP-UX 11.22
- HP HP-UX 11.23
- MandrakeSoft Mandrake Linux 9.2 AMD64
- MandrakeSoft Mandrake Linux 9.2
- MandrakeSoft Mandrake Linux Corporate Server 2.1
- MandrakeSoft Mandrake Linux Corporate Server 2.1 X86_64
- RedHat Enterprise Linux 2.1 WS
- RedHat Enterprise Linux 2.1 ES
- RedHat Enterprise Linux 2.1 AS
- RedHat Linux Advanced Workstation 2.1 Itanium
- Samba Samba 2.2.0
- Samba Samba 2.2.0a
- Samba Samba 2.2.11
- Samba Samba 2.2.1a
- Samba Samba 2.2.2
- Samba Samba 2.2.3
- Samba Samba 2.2.3a
- Samba Samba 2.2.4
- Samba Samba 2.2.5
- Samba Samba 2.2.6
- Samba Samba 2.2.7
- Samba Samba 2.2.7a
- Samba Samba 2.2.8
- Samba Samba 2.2.8a
- Samba Samba 2.2.9
- Samba Samba 2.2a
- Samba Samba 3.0 Alpha
- Samba Samba 3.0.0
- Samba Samba 3.0.1
- Samba Samba 3.0.2
- Samba Samba 3.0.2a
- Sun JDS 2003
- Sun JDS Release 2
- SuSE Linux Enterprise Server 8
- SUSE SuSE Linux 8.1
- SUSE SuSE Linux 8.2
- SUSE SuSE Linux 9.0
- SuSE SuSE Linux Desktop 1.0
- Trustix Secure Linux 1.5
- Trustix Secure Linux 2.0
Reported:
Sep 30, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net