This release of Samba fixes some Serious security bugs :

  - CVE-2007-2444

    - CVE-2007-2446

    - CVE-2007-2447

Official upstream announcements here:
http://www.samba.org/samba/security/CVE-2007-2444.html http://www.samba.org/samba/security/CVE-2007-2446.html http://www.samba.org/samba/security/CVE-2007-2447.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

そのバナーによると、リモートホストにインストールされているバージョンのSambaは、ローカルの権限昇格のバグに加えて、リモートから悪用される可能性のある、複数のバッファオーバーフローおよびリモートコマンドインジェクションの脆弱性の影響を受けます。

根據其標題，遠端主機上執行的 Samba 伺服器版本受到多個緩衝區溢位與遠端命令插入弱點的影響 (這些弱點均可從遠端利用)，此外還有一個本機權限提升錯誤 。

根据其标题，远程主机上安装的 Samba 服务器版本受到多个缓冲区溢出和远程命令注入漏洞（可被远程利用），以及一个本地特权提升错误的影响。

According to its banner, the version of the Samba server installed on the remote host is affected by multiple buffer overflow and remote command injection vulnerabilities, which can be exploited remotely, as well as a local privilege escalation bug.

New samba packages are available for Slackware 10.0, 10.1, 10.2, 11.0, and -current to fix security issues.

USN-460-1 fixed several vulnerabilities in Samba. The upstream changes for CVE-2007-2444 had an unexpected side-effect in Feisty. Shares configured with the 'force group' option no longer behaved correctly.
This update corrects the problem. We apologize for the inconvenience.

Paul Griffith and Andrew Hogue discovered that Samba did not fully drop root privileges while translating SIDs. A remote authenticated user could issue SMB operations during a small window of opportunity and gain root privileges. (CVE-2007-2444).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200705-15 (Samba: Multiple vulnerabilities)

    Samba contains a logical error in the smbd daemon when translating     local SID to user names (CVE-2007-2444). Furthermore, Samba contains     several bugs when parsing NDR encoded RPC parameters (CVE-2007-2446).
    Lastly, Samba fails to properly sanitize remote procedure input     provided via Microsoft Remote Procedure Calls (CVE-2007-2447).
  Impact :

    A remote attacker could exploit these vulnerabilities to gain root     privileges via various vectors.
  Workaround :

    There is no known workaround at this time.

Specially crafted MS-RPC packets could overwrite heap memory and therfore could potentially be exploited to execute code (CVE-2007-2446).

Authenticated users could leverage specially crafted MS-RPC packets to pass arguments unfiltered to /bin/sh (CVE-2007-2447).

A bug in the local SID/Name translation routines may potentially result in a user being able to issue SMB protocol operations as root (CVE-2007-2444).

A number of bugs were discovered in the NDR parsing support in Samba that is used to decode MS-RPC requests. A remote attacker could send a carefully crafted request that would cause a heap overflow, possibly leading to the ability to execute arbitrary code on the server (CVE-2007-2446).

A remote authenticated user could trigger a flaw where unescaped user input parameters were being passed as arguments to /bin/sh (CVE-2007-2447).

Finally, on Samba 3.0.23d and higher, when Samba translated SID to/from name using the Samba local list of user and group accounts, a logic error in smbd's internal security stack could result in a transition to the root user id rather than the non-root user (CVE-2007-2444).

Update :

The fix for CVE-2007-2444 broke the behaviour of force group when the forced group is a local Unix group for domain member servers.

This update corrects that regression.

The Samba Team reports :

A bug in the local SID/Name translation routines may potentially result in a user being able to issue SMB/CIFS protocol operations as root.

When translating SIDs to/from names using Samba local list of user and group accounts, a logic error in the smbd daemon's internal security stack may result in a transition to the root user id rather than the non-root user. The user is then able to temporarily issue SMB/CIFS protocol operations as the root user. This window of opportunity may allow the attacker to establish additional means of gaining root access to the server.

Various bugs in Samba's NDR parsing can allow a user to send specially crafted MS-RPC requests that will overwrite the heap space with user defined data.

Unescaped user input parameters are passed as arguments to /bin/sh allowing for remote command execution.

This bug was originally reported against the anonymous calls to the SamrChangePassword() MS-RPC function in combination with the 'username map script' smb.conf option (which is not enabled by default).

After further investigation by Samba developers, it was determined that the problem was much broader and impacts remote printer and file share management as well. The root cause is passing unfiltered user input provided via MS-RPC calls to /bin/sh when invoking externals scripts defined in smb.conf. However, unlike the 'username map script' vulnerability, the remote file and printer management scripts require an authenticated user session.

Several issues have been identified in Samba, the SMB/CIFS file- and print-server implementation for GNU/Linux.

  - CVE-2007-2444     When translating SIDs to/from names using Samba local     list of user and group accounts, a logic error in the     smbd daemon's internal security stack may result in a     transition to the root user id rather than the non-root     user. The user is then able to temporarily issue     SMB/CIFS protocol operations as the root user. This     window of opportunity may allow the attacker to     establish addition means of gaining root access to the     server.

  - CVE-2007-2446     Various bugs in Samba's NDR parsing can allow a user to     send specially crafted MS-RPC requests that will     overwrite the heap space with user defined data.

  - CVE-2007-2447     Unescaped user input parameters are passed as arguments     to /bin/sh allowing for remote command execution.

Paul Griffith and Andrew Hogue discovered that Samba did not fully drop root privileges while translating SIDs. A remote authenticated user could issue SMB operations during a small window of opportunity and gain root privileges. (CVE-2007-2444)

Brian Schafer discovered that Samba did not handle NDR parsing correctly. A remote attacker could send specially crafted MS-RPC requests that could overwrite heap memory and execute arbitrary code.
(CVE-2007-2446)

It was discovered that Samba did not correctly escape input parameters for external scripts defined in smb.conf. Remote authenticated users could send specially crafted MS-RPC requests and execute arbitrary shell commands. (CVE-2007-2447).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of the Samba server installed on the remote host is affected by multiple buffer overflow and remote command injection vulnerabilities that can be exploited remotely, as well as a local privilege escalation bug. 

ID	名前	製品	ファミリー	公開日	更新日	深刻度
25233	Fedora Core 5 : samba-3.0.24-5.fc5 (2007-506)	Nessus	Fedora Local Security Checks	2007/5/16	2021/1/11	high
25217	Samba < 3.0.25 の複数の脆弱性	Nessus	Misc.	2007/5/15	2018/7/27	critical
25217	Samba < 3.0.25 多個弱點	Nessus	Misc.	2007/5/15	2018/7/27	critical
25217	Samba < 3.0.25 多种漏洞	Nessus	Misc.	2007/5/15	2018/7/27	critical
25217	Samba < 3.0.25 Multiple Vulnerabilities	Nessus	Misc.	2007/5/15	2018/7/27	critical
25222	Slackware 10.0 / 10.1 / 10.2 / 11.0 / current : samba (SSA:2007-134-01)	Nessus	Slackware Local Security Checks	2007/5/16	2021/1/14	critical
28060	Ubuntu 7.04 : samba regression (USN-460-2)	Nessus	Ubuntu Local Security Checks	2007/11/10	2021/1/19	high
25236	GLSA-200705-15 : Samba: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2007/5/16	2021/1/6	critical
25234	Fedora Core 6 : samba-3.0.24-5.fc6 (2007-507)	Nessus	Fedora Local Security Checks	2007/5/16	2021/1/11	high
27430	openSUSE 10 Security Update : samba (samba-3350)	Nessus	SuSE Local Security Checks	2007/10/17	2021/1/14	critical
25237	Mandrake Linux Security Advisory : samba (MDKSA-2007:104-1)	Nessus	Mandriva Local Security Checks	2007/5/16	2021/1/6	critical
25260	FreeBSD : samba -- multiple vulnerabilities (3546a833-03ea-11dc-a51d-0019b95d4f14)	Nessus	FreeBSD Local Security Checks	2007/5/20	2021/1/6	critical
25228	Debian DSA-1291-1 : samba - several vulnerabilities	Nessus	Debian Local Security Checks	2007/5/16	2021/1/4	critical
28059	Ubuntu 6.06 LTS / 6.10 / 7.04 : samba vulnerabilities (USN-460-1)	Nessus	Ubuntu Local Security Checks	2007/11/10	2021/1/19	critical
3990	Samba < 3.0.25 Multiple Vulnerabilities	Nessus Network Monitor	Samba	2007/5/16	2019/3/6	high

検出

プラグインの検索

high

critical

critical

critical

critical

critical

high

critical

high

critical

critical

critical

critical

critical

high