| Beschreibung: | Summary:
The remote host is missing an update for the 'samba'
package(s) announced via the referenced advisory.
Vulnerability Insight:
Multiple vulnerabilities has been discovered and corrected in
samba/cifs-utils:
smbfs in Samba 3.5.8 and earlier attempts to use (1) mount.cifs to
append to the /etc/mtab file and (2) umount.cifs to append to the
/etc/mtab.tmp file without first checking whether resource limits
would interfere, which allows local users to trigger corruption of
the /etc/mtab file via a process with a small RLIMIT_FSIZE value,
a related issue to CVE-2011-1089 (CVE-2011-1678).
The check_mtab function in client/mount.cifs.c in mount.cifs in
smbfs in Samba 3.5.10 and earlier does not properly verify that the
(1) device name and (2) mountpoint strings are composed of valid
characters, which allows local users to cause a denial of service
(mtab corruption) via a crafted string. NOTE: this vulnerability
exists because of an incorrect fix for CVE-2010-0547 (CVE-2011-2724).
Additionally for Mandriva Linux 2010.2 the cifs-utils package has been
upgraded to the 4.8.1 version that brings numerous additional fixes.
Packages for 2009.0 are provided as of the Extended Maintenance
Program. The updated packages have been patched to correct these issues.
Affected Software/OS:
samba on Mandriva Linux 2009.0,
Mandriva Linux 2009.0/X86_64,
Mandriva Linux 2010.1,
Mandriva Linux 2010.1/X86_64,
Mandriva Enterprise Server 5,
Mandriva Enterprise Server 5/X86_64
Solution:
Please Install the Updated Packages.
CVSS Score:
3.3
CVSS Vector:
AV:L/AC:M/Au:N/C:P/I:P/A:N
|
