samba - Oct 2004 - ERRATA: Potential Arbitrary File Access (CAN-2004-0815)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

ERRATA
- ------

The original announcement for the Samba vulnerability identified
by CAN-2004-0815 reported that Samba versions 3.0.0 - 3.0.5
inclusive were subject the remote file access bug.  Later research
has confirmed that *only* Samba 3.0.x <= 3.0.2a contains the
exploitable code.

The Samba Team expresses sincere apologies for any confusion
this inaccuracy in the original announcement has caused.


Updated Security Announcement
- -----------------------------

Subject:	Potential Arbitrary File Access

Affected
Versions:	Samba 2.2.x <= 2.2.11 and Samba 3.0.x <= 3.0.2a

Summary:	A remote attacker may be able to gain access
		to files which exist outside of the share's
		defined path. Such files must still be readable
		by the account used for the connection.


Patch Availability
- ------------------
The patch for Samba 3.0.2a and earlier releases 3.0.x
(samba-3.0.2a-reduce_name.patch) can be downloaded
from http://download.samba.org/samba/ftp/patches/security/

Samba 2.2.12 has been released to specifically address
this bug.


Description
- -----------

A bug in the input validation routines used to convert DOS
path names to path names on the Samba host's file system
may be exploited to gain access to files outside of the
share's path defined by smb.conf.


Protecting Unpatched Servers
- ----------------------------

Samba file shares with 'wide links = no' (a non-default setting)
in the service definition in smb.conf are *not* vulnerable to
this attack.

The Samba Team always encourages users to run the latest stable
release as a defense of against attacks.  However, under certain
circumstances it may not be possible to immediately upgrade
important installations.  In such cases, administrators should
read the "Server Security" documentation found at
http://www.samba.org/samba/docs/server_security.html.


Credits
- --------

Both security issues were reported to Samba developers by
iDEFENSE (http://www.idefense.com/).  Karol Wiesek is credited
with this discovery.



- --

Please report any security related issues to <security@samba.org>
Our Code, Our Bugs, Our Responsibility.


				-- The Samba Team






-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFBYwUjIR7qMdg1EfYRAjlAAKCSsMiDnq7gEFfaizA33mhp0w51cgCfd1ov
mIzM8w2CpSas2oa6/zJkO2s=7h9O
-----END PGP SIGNATURE-----