samba announce - May 2007 - [SAMBA-SECURITY] CVE-2007-2447: Remote Command Injection Vulnerability

Spam detection software, running on the system
"mail.montanhydraulik.com", has
identified this incoming email as possible spam.  The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email.  If you have any questions, see
postmaster for details.

Content preview:  -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
  ========================================================== == =  Subject:
Remote Command Injection Vulnerability == CVE ID#:
  CVE-2007-2447 == == Versions: Samba 3.0.0 - 3.0.25rc3 (inclusive) == = 
Summary: Unescaped user input parameters are passed == as arguments to
  /bin/sh allowing for remote == command execution = 
========================================================== [...]

Content analysis details:   (5.4 points, 5.0 required)

 pts rule name              description
---- ---------------------- --------------------------------------------------
 0.1 FORGED_RCVD_HELO       Received: contains a forged HELO
 1.2 DATE_IN_PAST_12_24     Date: is 12 to 24 hours before Received: date
 2.0 RCVD_IN_SORBS_DUL      RBL: SORBS: sent directly from dynamic IP address
                            [68.117.186.136 listed in dnsbl.sorbs.net]
 1.9 RCVD_IN_NJABL_DUL      RBL: NJABL: dialup sender did non-local SMTP
                            [68.117.186.136 listed in combined.njabl.org]


-------------- next part --------------
An embedded message was scrubbed...
From: "Gerald (Jerry) Carter" <jerry@samba.org>
Subject: [SAMBA-SECURITY] CVE-2007-2447: Remote Command Injection Vulnerability
Date: Sun, 13 May 2007 17:53:12 -0500
Size: 5947
Url:
http://lists.samba.org/archive/samba-announce/attachments/20070513/ae55a411/attachment-0001.eml