Fixed a format string vulnerability in smbclient (CVE-2009-1886) and a ACL bypass vulnerability in samba. (CVE-2009-1888)

バージョン番号によると、リモートホストで実行されているSambaのバージョンに、セキュリティバイパスの脆弱性があります。smbdでの初期化されていないデータの読み取りにより、アクセス制限がバイパスされる可能性があります。これにより、ユーザーは権限を拒否される必要がある場合でも、アクセスコントロールリスト（ACL）を変更できる可能性があります。

なお、攻撃を成功させるには、smb.confで「dos filemode」パラメーターを「yes」に設定する必要があります（デフォルト設定は「no」）。

注意：smbclientのバージョン 3.2.0 〜 3.2.12 は書式文字列の脆弱性の影響を受けますが、Nessusはこれをチェックしていません。

根据其版本号，远程主机上运行的 Samba 版本存在一个安全绕过漏洞。可绕过访问限制，这是读取 smbd 中未初始化的数据所致。这可允许用户修改访问控制列表 (ACL)，即使应当予以拒绝时亦是如此。

请注意，必须在 smb.conf 中将“dos filemode”参数设置为“yes”，才能使攻击成功（默认设置为“no”）。

另请注意，smbclient 版本 3.2.0 - 3.2.12 受到一个格式字符串漏洞的影响，但 Nessus 尚未对此进行检查。

Fixed a format string vulnerability in smbclient (CVE-2009-1886) and a ACL bypass vulnerability in samba (CVE-2009-1888).

Fixed a format string vulnerability in smbclient (CVE-2009-1886) and a ACL bypass vulnerability in samba. (CVE-2009-1888)

Also a printing issue in KRB5 setups was fixed.

According to its version number, the version of Samba running on the remote host has a security bypass vulnerability.  Access restrictions can be bypassed due to a read of uninitialized data in smbd.  This could allow a user to modify an access control list (ACL), even when they should be denied permission.

Note the 'dos filemode' parameter must be set to 'yes' in smb.conf in order for an attack to be successful (the default setting is 'no').

Also note versions 3.2.0 - 3.2.12 of smbclient are affected by a format string vulnerability, though Nessus has not checked for this.

New samba packages are available for Slackware 10.0, 10.1, 10.2, 11.0, 12.0, 12.1, 12.2, and -current to fix security issues.

根據其版本號碼來判斷，遠端主機上執行的 Samba 版本有一個安全性繞過弱點。由於 smbd 中存在讀取未初始化資料的問題，因而使用者可繞過存取限制。這可允許使用者修改存取控制清單 (ACL)，即使應該拒絕其權限也是如此。

請注意，必須先在 smb.conf 中將「dos filemode」參數設定為「yes」，攻擊才會成功 (預設設定為「no」)。

另請注意，smbclient 的 3.2.0 - 3.2.12 版受到一個格式字串弱點影響，但 Nessus 尚未檢查此問題。

Several vulnerabilities have been discovered in Samba, a SMB/CIFS file, print, and login server. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-1886     The smbclient utility contains a formatstring     vulnerability where commands dealing with file names     treat user input as format strings to asprintf.

  - CVE-2009-1888     In the smbd daemon, if a user is trying to modify an     access control list (ACL) and is denied permission, this     deny may be overridden if the parameter 'dos filemode'     is set to 'yes' in the smb.conf and the user already has     write access to the file.

Multiple vulnerabilities has been found and corrected in samba :

Multiple format string vulnerabilities in client/client.c in smbclient in Samba 3.2.0 through 3.2.12 might allow context-dependent attackers to execute arbitrary code via format string specifiers in a filename (CVE-2009-1886).

The acl_group_override function in smbd/posix_acls.c in smbd in Samba 3.0.x before 3.0.35, 3.1.x and 3.2.x before 3.2.13, and 3.3.x before 3.3.6, when dos filemode is enabled, allows remote attackers to modify access control lists for files via vectors related to read access to uninitialized memory (CVE-2009-1888).

This update provides samba 3.2.13 to address these issues.

J. David Hester discovered that Samba incorrectly handled users that lack home directories when the automated [homes] share is enabled. An authenticated user could connect to that share name and gain access to the whole filesystem. (CVE-2009-2813)

Tim Prouty discovered that the smbd daemon in Samba incorrectly handled certain unexpected network replies. A remote attacker could send malicious replies to the server and cause smbd to use all available CPU, leading to a denial of service. (CVE-2009-2906)

Ronald Volgers discovered that the mount.cifs utility, when installed as a setuid program, would not verify user permissions before opening a credentials file. A local user could exploit this to use or read the contents of unauthorized credential files. (CVE-2009-2948)

Reinhard Nissl discovered that the smbclient utility contained format string vulnerabilities in its file name handling. Because of security features in Ubuntu, exploitation of this vulnerability is limited. If a user or automated system were tricked into processing a specially crafted file name, smbclient could be made to crash, possibly leading to a denial of service. This only affected Ubuntu 8.10.
(CVE-2009-1886)

Jeremy Allison discovered that the smbd daemon in Samba incorrectly handled permissions to modify access control lists when dos filemode is enabled. A remote attacker could exploit this to modify access control lists. This only affected Ubuntu 8.10 and Ubuntu 9.04.
(CVE-2009-1886).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of the Samba server on the remote host has a security bypass vulnerability. Access restrictions can be bypassed due to a read of uninitialized data in smbd. This could allow a user to modify an access control list (ACL), even when they should be denied permission.

Note the 'dos filemode' parameter must be set to 'yes' in smb.conf in order for an attack to be successful (the default setting is 'no').

ID	名前	製品	ファミリー	公開日	更新日	深刻度
41372	SuSE 11 Security Update : Samba (SAT Patch Number 1053)	Nessus	SuSE Local Security Checks	2009/9/24	2021/1/14	high
39502	Samba < 3.0.35 / 3.2.13 / 3.3.6の複数の脆弱性	Nessus	Misc.	2009/6/24	2018/11/15	low
39502	Samba < 3.0.35 / 3.2.13 / 3.3.6 多种漏洞	Nessus	Misc.	2009/6/24	2018/11/15	low
40198	openSUSE Security Update : cifs-mount (cifs-mount-1036)	Nessus	SuSE Local Security Checks	2009/7/21	2021/1/14	high
41483	SuSE 10 Security Update : Samba (ZYPP Patch Number 6343)	Nessus	SuSE Local Security Checks	2009/9/24	2021/1/14	high
39502	Samba < 3.0.35 / 3.2.13 / 3.3.6 Multiple Vulnerabilities	Nessus	Misc.	2009/6/24	2018/11/15	low
39559	Slackware 10.0 / 10.1 / 10.2 / 11.0 / 12.0 / 12.1 / 12.2 / current : samba (SSA:2009-177-01)	Nessus	Slackware Local Security Checks	2009/6/28	2021/1/14	high
39502	Samba < 3.0.35 / 3.2.13 / 3.3.6 多個弱點	Nessus	Misc.	2009/6/24	2018/11/15	low
39568	Debian DSA-1823-1 : samba - several vulnerabilities	Nessus	Debian Local Security Checks	2009/6/30	2021/1/4	high
39928	openSUSE Security Update : cifs-mount (cifs-mount-1036)	Nessus	SuSE Local Security Checks	2009/7/21	2021/1/14	high
40521	Mandriva Linux Security Advisory : samba (MDVSA-2009:196)	Nessus	Mandriva Local Security Checks	2009/8/10	2021/1/6	high
41968	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 : samba vulnerabilities (USN-839-1)	Nessus	Ubuntu Local Security Checks	2009/10/2	2021/1/19	high
5087	Samba < 3.3.6 / 3.2.13 / 3.0.35 Multiple Vulnerabilities	Nessus Network Monitor	Samba	2004/8/18	2019/3/6	high

検出

プラグインの検索

high

low

low

high

high

low

high

low

high

high

high

high

high