Moritz Muehlenhoff
2010-Jan-29 18:17 UTC
[Secure-testing-team] Bug#567554: Privilege escalation in mount.cifs
Package: smbfs
Severity: grave
Tags: security
This is CVE-2009-3297:
https://bugzilla.samba.org/show_bug.cgi?id=6853
/usr/share/doc/smbfs/TODO.Debian states:
There is concern about the setuid status of binaries in this package.
The audit status of the concerned binaries is unclear. We should
figure out whether it is reasonable to provide the flexible user mount
capabilities or whether a more restricted setup is better, at least by
default.
Given that Jeremy Allison writes in the bug above you should probably
drop the setuid for Squeeze:
------- Comment [88]#2 From [89]Jeremy Allison 2009-10-28 12:51:31 CST
-------
I object strongly to dealing with this as a Samba security issue. This code has
not bee audited AND MUST NOT BE SHIPPED SETUID root.
Cheers,
Moritz
-- System Information:
Debian Release: squeeze/sid
APT prefers unstable
APT policy: (500, ''unstable'')
Architecture: i386 (i686)
Kernel: Linux 2.6.32-trunk-686 (SMP w/1 CPU core)
Locale: LANG=C, LC_CTYPE=de_DE.ISO-8859-15 at euro (charmap=ISO-8859-15)
Shell: /bin/sh linked to /bin/bash
Versions of packages smbfs depends on:
ii libc6 2.10.2-2 GNU C Library: Shared libraries
ii libcomerr2 1.41.9-1 common error description library
ii libkeyutils1 1.2-12 Linux Key Management Utilities (li
ii libkrb53 1.6.dfsg.4~beta1-13 Transitional library package/krb4
ii libldap-2.4-2 2.4.17-2.1 OpenLDAP libraries
ii libpopt0 1.15-1 lib for parsing cmdline parameters
pn libtalloc1 <none> (no description available)
ii libwbclient0 2:3.4.3-2 Samba winbind client library
ii netbase 4.40 Basic TCP/IP networking system
pn samba-common <none> (no description available)
smbfs recommends no packages.
Versions of packages smbfs suggests:
pn smbclient <none> (no description available)