Fedora alert FEDORA-2008-4679 (samba)
| From: | updates@fedoraproject.org | |
| To: | fedora-package-announce@redhat.com | |
| Subject: | [SECURITY] Fedora 8 Update: samba-3.0.30-0.fc8 | |
| Date: | Sat, 31 May 2008 02:12:00 +0000 | |
| Message-ID: | <200805310211.m4V2BA3G023628@bastion.fedora.phx.redhat.com> |
-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2008-4679 2008-05-30 23:36:09 -------------------------------------------------------------------------------- Name : samba Product : Fedora 8 Version : 3.0.30 Release : 0.fc8 URL : http://www.samba.org/ Summary : The Samba Suite of programs Description : Samba is the suite of programs by which a lot of PC-related machines share files, printers, and other information (such as lists of available files and printers). The Windows NT, OS/2, and Linux operating systems support this natively, and add-on packages can enable the same thing for DOS, Windows, VMS, UNIX of all kinds, MVS, and more. This package provides an SMB/CIFS server that can be used to provide network services to SMB/CIFS clients. Samba uses NetBIOS over TCP/IP (NetBT) protocols and does NOT need the NetBEUI (Microsoft Raw NetBIOS frame) protocol. -------------------------------------------------------------------------------- Update Information: Fix CVE-2008-1105 A heap-based buffer overflow flaw has been found in the way Samba clients handle over-sized packets. If a client connected to a malicious Samba server, it was possible to execute arbitrary code as the Samba client user. The Samba server can also act as a client to perform some operations (print notify, domain member vs domain controler ...). This could result in the server executing the vulnerable client code, resulting in arbitrary code execution with the permissions of the Samba server. -------------------------------------------------------------------------------- ChangeLog: * Wed May 28 2008 Simo Sorce <ssorce@redhat.com> 3.0.30-0.fc8 - New upstream security release to fix CVE-2008-1105 * Wed May 21 2008 Simo Sorce <ssorce@redhat.com> 3.0.29-1.fc8 - Fix packaging issue * Wed May 21 2008 Simo Sorce <ssorce@redhat.com> 3.0.29-0.fc8 - New upstream bugfix release * Sun Mar 9 2008 Simo Sorce <ssorce@redhat.com> 3.0.28a-0.fc8 - New upstream bugfix release * Mon Dec 10 2007 Simo Sorce <ssorce@redhat.com> 3.0.28-0.fc8 - Fix CVE-2007-6015 * Wed Nov 21 2007 Simo Sorce <ssorce@redhat.com> 3.0.27a-0.fc8 - Upstream official fix for regression in CVE-2007-4572 - More fixes including 2 former patches we had in the package * Mon Nov 19 2007 Simo Sorce <ssorce@redhat.com> 3.0.27-1.fc8 - Fix regression in CVE-2007-4572 * Thu Nov 15 2007 Simo Sorce <ssorce@redhat.com> 3.0.27-0.fc8 - Fix CVE-2007-4572 - Fix CVE-2007-5398 -------------------------------------------------------------------------------- References: [ 1 ] Bug #446724 - CVE-2008-1105 Samba client buffer overflow https://bugzilla.redhat.com/show_bug.cgi?id=446724 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update samba' at the command line. For more information, refer to "Managing Software with yum", available at http://docs.fedoraproject.org/yum/. All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at http://fedoraproject.org/keys -------------------------------------------------------------------------------- _______________________________________________ Fedora-package-announce mailing list Fedora-package-announce@redhat.com http://www.redhat.com/mailman/listinfo/fedora-package-ann...