-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-1291-1                security@debian.org
http://www.debian.org/security/                         Noah Meyerhans
May 15, 2007
- ------------------------------------------------------------------------

Package        : samba
Vulnerability  : several
Problem type   : remote
Debian-specific: no
CVE Id(s)      : CVE-2007-2444 CVE-2007-2446 CVE-2007-2447

Several issues have been identified in Samba, the SMB/CIFS
file- and print-server implementation for GNU/Linux.

CVE-2007-2444
When translating SIDs to/from names using Samba local list of user and
group accounts, a logic error in the smbd daemon's internal security
stack may result in a transition to the root user id rather than the
non-root user.  The user is then able to temporarily issue SMB/CIFS
protocol operations as the root user.  This window of opportunity may
allow the attacker to establish addition means of gaining root access to
the server.

CVE-2007-2446
Various bugs in Samba's NDR parsing can allow a user to send specially
crafted MS-RPC requests that will overwrite the heap space with user
defined data.

CVE-2007-2447
Unescaped user input parameters are passed as arguments to /bin/sh
allowing for remote command execution

For the stable distribution (etch), these problems have been fixed in
version 3.0.24-6etch1

For the testing and unstable distributions (lenny and sid,
respectively), these problems have been fixed in version 3.0.25-1

We recommend that you upgrade your samba package.

Upgrade instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian (stable)
- ---------------

Stable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

  http://security.debian.org/pool/updates/main/s/samba/samba_3.0.24-6etch1.dsc
    Size/MD5 checksum:     1425 04c3ba2544a4dba0e23748697bbcb93c
  http://security.debian.org/pool/updates/main/s/samba/samba_3.0.24.orig.tar.gz
    Size/MD5 checksum: 17708128 89273f67a6d8067cbbecefaa13747153
  http://security.debian.org/pool/updates/main/s/samba/samba_3.0.24-6etch1.diff.gz
    Size/MD5 checksum:   209279 01a1d7d0cb1afcb8cff7da5937c72318

Architecture independent packages:

  http://security.debian.org/pool/updates/main/s/samba/samba-doc_3.0.24-6etch1_all.deb
    Size/MD5 checksum:  6913100 ad2bda3c198d48346696f83dcc44a919
  http://security.debian.org/pool/updates/main/s/samba/samba-doc-pdf_3.0.24-6etch1_all.deb
    Size/MD5 checksum:  6598732 ae5dd6f0ee9ede4135507778fe939c5b

alpha architecture (DEC Alpha)

  http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.0.24-6etch1_alpha.deb
    Size/MD5 checksum: 12298820 361c9a38d1601d5f40b5999712b421ce
  http://security.debian.org/pool/updates/main/s/samba/smbclient_3.0.24-6etch1_alpha.deb
    Size/MD5 checksum:  4845328 6cadfc3b139943f558066c08737d43f6
  http://security.debian.org/pool/updates/main/s/samba/winbind_3.0.24-6etch1_alpha.deb
    Size/MD5 checksum:  2286174 f020a21acc276108270b364574635bff
  http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.0.24-6etch1_alpha.deb
    Size/MD5 checksum:   879246 cd710df2be2d347a3a57d4aeb3e538e0
  http://security.debian.org/pool/updates/main/s/samba/python-samba_3.0.24-6etch1_alpha.deb
    Size/MD5 checksum:  6705430 2b66a4a7d2e202592af3e76143246085
  http://security.debian.org/pool/updates/main/s/samba/swat_3.0.24-6etch1_alpha.deb
    Size/MD5 checksum:   956068 c78ed74384834b23fc0cdb744eae6ca4
  http://security.debian.org/pool/updates/main/s/samba/smbfs_3.0.24-6etch1_alpha.deb
    Size/MD5 checksum:   521138 be541e59b60bbaf52cb410ae77afe8a9
  http://security.debian.org/pool/updates/main/s/samba/samba_3.0.24-6etch1_alpha.deb
    Size/MD5 checksum:  4000850 42c314e7c7baa6713e34fff690b94b63
  http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.0.24-6etch1_alpha.deb
    Size/MD5 checksum:   482750 962077ae64d617de90980ca7536844e2
  http://security.debian.org/pool/updates/main/s/samba/samba-common_3.0.24-6etch1_alpha.deb
    Size/MD5 checksum:  2841098 0b9e462523e6e5deb926833b64738751
  http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.0.24-6etch1_alpha.deb
    Size/MD5 checksum:   113804 2596db0188695f092541f23d5e702842

amd64 architecture (AMD x86_64 (AMD64))

  http://security.debian.org/pool/updates/main/s/samba/samba-common_3.0.24-6etch1_amd64.deb
    Size/MD5 checksum:  2596718 117b0b1a3193555a92616ee3ff0da86e
  http://security.debian.org/pool/updates/main/s/samba/smbclient_3.0.24-6etch1_amd64.deb
    Size/MD5 checksum:  4313262 db755a802d383326238d0a097ed1a414
  http://security.debian.org/pool/updates/main/s/samba/swat_3.0.24-6etch1_amd64.deb
    Size/MD5 checksum:   866346 074ca20601c8b3cbc51d789111dab2d9
  http://security.debian.org/pool/updates/main/s/samba/samba_3.0.24-6etch1_amd64.deb
    Size/MD5 checksum:  3601326 0f3a2fdcb3f6eb6fc389b3e59e8f5322
  http://security.debian.org/pool/updates/main/s/samba/winbind_3.0.24-6etch1_amd64.deb
    Size/MD5 checksum:  2074422 c9ad0ee8260f636c9c90b8d9d2afe478
  http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.0.24-6etch1_amd64.deb
    Size/MD5 checksum: 12190696 4c185a1d0ecab5f38d2d3d64593ae250
  http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.0.24-6etch1_amd64.deb
    Size/MD5 checksum:   831218 68db9d99816eb815890cdfe086632fbb
  http://security.debian.org/pool/updates/main/s/samba/smbfs_3.0.24-6etch1_amd64.deb
    Size/MD5 checksum:   456592 e1e40461c0318acf4c439e9d83d9f7ae
  http://security.debian.org/pool/updates/main/s/samba/python-samba_3.0.24-6etch1_amd64.deb
    Size/MD5 checksum:  6254606 267d6c998a186f4416de23cede305739
  http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.0.24-6etch1_amd64.deb
    Size/MD5 checksum:   461594 c5cd65237a6361d3790e6277c84f4830
  http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.0.24-6etch1_amd64.deb
    Size/MD5 checksum:   112092 c22e8aaa62deb3e1ceb5972acd9090e5

hppa architecture (HP PA RISC)

  http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.0.24-6etch1_hppa.deb
    Size/MD5 checksum:   112084 32e2be10c3bf29746505221056ae358a
  http://security.debian.org/pool/updates/main/s/samba/smbclient_3.0.24-6etch1_hppa.deb
    Size/MD5 checksum:  4428150 4e53b7ec668d6156452469ecc0a51051
  http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.0.24-6etch1_hppa.deb
    Size/MD5 checksum:   484206 ccabe214660f062d6070db209a259e4d
  http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.0.24-6etch1_hppa.deb
    Size/MD5 checksum:   877280 4b2ae61f6c51854b06249ebf0c746fd6
  http://security.debian.org/pool/updates/main/s/samba/smbfs_3.0.24-6etch1_hppa.deb
    Size/MD5 checksum:   470476 6f76bdef8b9f4894fa44fd426c00a90a
  http://security.debian.org/pool/updates/main/s/samba/python-samba_3.0.24-6etch1_hppa.deb
    Size/MD5 checksum:  6562278 1b84e2389afc3c8105df0e53af6f0166
  http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.0.24-6etch1_hppa.deb
    Size/MD5 checksum: 11912634 e01b0888203c9fb07cee7d1c93528132
  http://security.debian.org/pool/updates/main/s/samba/winbind_3.0.24-6etch1_hppa.deb
    Size/MD5 checksum:  2135120 cc819588fa69b8a84ccbfb9678e5a72b
  http://security.debian.org/pool/updates/main/s/samba/swat_3.0.24-6etch1_hppa.deb
    Size/MD5 checksum:   885710 3dc27bc180a74e7f8236ca4542f4dc2c
  http://security.debian.org/pool/updates/main/s/samba/samba-common_3.0.24-6etch1_hppa.deb
    Size/MD5 checksum:  2647730 28540ba66a7863ccaa663bd07c9c5a78
  http://security.debian.org/pool/updates/main/s/samba/samba_3.0.24-6etch1_hppa.deb
    Size/MD5 checksum:  3697062 9c6830b8952dd726d4464b55d897b441

i386 architecture (Intel ia32)

  http://security.debian.org/pool/updates/main/s/samba/samba-common_3.0.24-6etch1_i386.deb
    Size/MD5 checksum:  2381152 be2a088823984244c12f433367cb7e43
  http://security.debian.org/pool/updates/main/s/samba/samba_3.0.24-6etch1_i386.deb
    Size/MD5 checksum:  3260934 dd89988baf2a2a5666c04308741c192e
  http://security.debian.org/pool/updates/main/s/samba/winbind_3.0.24-6etch1_i386.deb
    Size/MD5 checksum:  1865236 7cca547c796723de84fad06c8513462e
  http://security.debian.org/pool/updates/main/s/samba/python-samba_3.0.24-6etch1_i386.deb
    Size/MD5 checksum:  5662336 22d72d620f89b1709d1f02db5a8bbbe1
  http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.0.24-6etch1_i386.deb
    Size/MD5 checksum: 11882486 6e3b3e334c9667758d16e839d3f66bef
  http://security.debian.org/pool/updates/main/s/samba/smbfs_3.0.24-6etch1_i386.deb
    Size/MD5 checksum:   412516 f3265d34230872fe63822ccad8e134a2
  http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.0.24-6etch1_i386.deb
    Size/MD5 checksum:   418526 8473b5b9a03b0d33e01b20a451b45899
  http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.0.24-6etch1_i386.deb
    Size/MD5 checksum:   757726 4a7e0d3fb6be42c1d5b3a6bd416dfe90
  http://security.debian.org/pool/updates/main/s/samba/swat_3.0.24-6etch1_i386.deb
    Size/MD5 checksum:   793296 512fec08054b45f82372161e4291e911
  http://security.debian.org/pool/updates/main/s/samba/smbclient_3.0.24-6etch1_i386.deb
    Size/MD5 checksum:  3880846 27c628acf8f8f614444ec30895c78f78
  http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.0.24-6etch1_i386.deb
    Size/MD5 checksum:   112084 c6d09df4ac3bf72d3f12de2b88ebb3d5

ia64 architecture (Intel ia64)

  http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.0.24-6etch1_ia64.deb
    Size/MD5 checksum: 11172948 97c6711185c37211439777a41d3c2cb3
  http://security.debian.org/pool/updates/main/s/samba/smbfs_3.0.24-6etch1_ia64.deb
    Size/MD5 checksum:   626988 dc3ba71d8b8a22e00bedfea2e45fa57b
  http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.0.24-6etch1_ia64.deb
    Size/MD5 checksum:  1068180 5289361cdddfe0f434305b155dfae717
  http://security.debian.org/pool/updates/main/s/samba/smbclient_3.0.24-6etch1_ia64.deb
    Size/MD5 checksum:  6079128 cd85e3ecb5730d548b540b0f3e9bef63
  http://security.debian.org/pool/updates/main/s/samba/winbind_3.0.24-6etch1_ia64.deb
    Size/MD5 checksum:  2883022 13d0ca301a6111fbf95fc66fd0273e95
  http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.0.24-6etch1_ia64.deb
    Size/MD5 checksum:   591756 c885ab514c125efd673250405fa5c694
  http://security.debian.org/pool/updates/main/s/samba/python-samba_3.0.24-6etch1_ia64.deb
    Size/MD5 checksum:  8087972 0edf67416c8436e90fe6f24d0a903d5c
  http://security.debian.org/pool/updates/main/s/samba/samba-common_3.0.24-6etch1_ia64.deb
    Size/MD5 checksum:  3476098 26b315a42c939a36b0a4217a69d6cd73
  http://security.debian.org/pool/updates/main/s/samba/swat_3.0.24-6etch1_ia64.deb
    Size/MD5 checksum:  1181398 6126d78eb2d1220401af9e23bdf5d312
  http://security.debian.org/pool/updates/main/s/samba/samba_3.0.24-6etch1_ia64.deb
    Size/MD5 checksum:  5041370 30447d1104aa64c4b153a940ff3bb789
  http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.0.24-6etch1_ia64.deb
    Size/MD5 checksum:   112088 fc008875e6d262be644a45a17a72c9c7

mips architecture (MIPS (Big Endian))

  http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.0.24-6etch1_mips.deb
    Size/MD5 checksum:   432746 7ea8cd6997ab3149a02ea2622da87fd1
  http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.0.24-6etch1_mips.deb
    Size/MD5 checksum:   753652 abe34cc4cb29ce9388d23acbbb255ff0
  http://security.debian.org/pool/updates/main/s/samba/winbind_3.0.24-6etch1_mips.deb
    Size/MD5 checksum:  2000526 6ae2083bd3aa9a7267da25997ace40a3
  http://security.debian.org/pool/updates/main/s/samba/python-samba_3.0.24-6etch1_mips.deb
    Size/MD5 checksum:  5492530 cdddd72b4205f49040dbb2967f29ba5d
  http://security.debian.org/pool/updates/main/s/samba/smbclient_3.0.24-6etch1_mips.deb
    Size/MD5 checksum:  4175528 3903a543e95c6e7c70c62e4cc3849ad7
  http://security.debian.org/pool/updates/main/s/samba/samba_3.0.24-6etch1_mips.deb
    Size/MD5 checksum:  3542680 09c463b2638c5163fc79681f7f180339
  http://security.debian.org/pool/updates/main/s/samba/smbfs_3.0.24-6etch1_mips.deb
    Size/MD5 checksum:   454024 fdf2853ff63622b75ec7e103068dcf91
  http://security.debian.org/pool/updates/main/s/samba/swat_3.0.24-6etch1_mips.deb
    Size/MD5 checksum:   832888 bb5db880a1016dc47f3077e5ec90718f
  http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.0.24-6etch1_mips.deb
    Size/MD5 checksum:   112090 d2b104f9800c1cc72951b44ab99a0d4c
  http://security.debian.org/pool/updates/main/s/samba/samba-common_3.0.24-6etch1_mips.deb
    Size/MD5 checksum:  2528098 1cd05b859916b7075c0b76fcebf95e4e
  http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.0.24-6etch1_mips.deb
    Size/MD5 checksum: 12721292 22efcdaedf6112d9e07867ca78ff47b6

mipsel architecture (MIPS (Little Endian))

  http://security.debian.org/pool/updates/main/s/samba/samba-common_3.0.24-6etch1_mipsel.deb
    Size/MD5 checksum:  2527908 91c8e019ae5b2120149ab7c920563754
  http://security.debian.org/pool/updates/main/s/samba/samba_3.0.24-6etch1_mipsel.deb
    Size/MD5 checksum:  3548740 4d5aabe33e53b1ec3d7c0397e9f7f33d
  http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.0.24-6etch1_mipsel.deb
    Size/MD5 checksum:   112094 1d36f7e76865fbc6ed6890740d0e7ea0
  http://security.debian.org/pool/updates/main/s/samba/swat_3.0.24-6etch1_mipsel.deb
    Size/MD5 checksum:   833962 d293a4f8fdd7ed57390ad110644fce31
  http://security.debian.org/pool/updates/main/s/samba/smbfs_3.0.24-6etch1_mipsel.deb
    Size/MD5 checksum:   454188 e066713bf985c0d21b3884704ef716eb
  http://security.debian.org/pool/updates/main/s/samba/winbind_3.0.24-6etch1_mipsel.deb
    Size/MD5 checksum:  2002348 58fa19e94640f71a0111b91336ce99bc
  http://security.debian.org/pool/updates/main/s/samba/smbclient_3.0.24-6etch1_mipsel.deb
    Size/MD5 checksum:  4173020 88bc50ea0528e76f53483d9ca41cac6b
  http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.0.24-6etch1_mipsel.deb
    Size/MD5 checksum:   754156 7388e5790cd225adb341b18943cee145
  http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.0.24-6etch1_mipsel.deb
    Size/MD5 checksum: 12367098 f7db764415f16e66718ed178c5f85237
  http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.0.24-6etch1_mipsel.deb
    Size/MD5 checksum:   432248 cde18ceec94836f518ae8c890bc10162
  http://security.debian.org/pool/updates/main/s/samba/python-samba_3.0.24-6etch1_mipsel.deb
    Size/MD5 checksum:  5485004 eee18419bf330a8088e7bc324f64ea43

powerpc architecture (PowerPC)

  http://security.debian.org/pool/updates/main/s/samba/swat_3.0.24-6etch1_powerpc.deb
    Size/MD5 checksum:   850436 0416faeed5767b2e0edb52ecf0a78241
  http://security.debian.org/pool/updates/main/s/samba/winbind_3.0.24-6etch1_powerpc.deb
    Size/MD5 checksum:  2028084 c7376b05df22ee4aa79126cc9a5195ac
  http://security.debian.org/pool/updates/main/s/samba/smbfs_3.0.24-6etch1_powerpc.deb
    Size/MD5 checksum:   456368 731295892c48c8f145ff75428c9154ae
  http://security.debian.org/pool/updates/main/s/samba/samba-common_3.0.24-6etch1_powerpc.deb
    Size/MD5 checksum:  2547460 932f5ca8fe45c64528396fa9f2a9beae
  http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.0.24-6etch1_powerpc.deb
    Size/MD5 checksum:   112094 e46062fd60fd4a9eb3f622fdf5f144f1
  http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.0.24-6etch1_powerpc.deb
    Size/MD5 checksum: 12443346 4e6acbf1ca2fd3e5f8d91985993b3e2a
  http://security.debian.org/pool/updates/main/s/samba/python-samba_3.0.24-6etch1_powerpc.deb
    Size/MD5 checksum:  6016288 e53dd47de7747ea05de274e30af5e943
  http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.0.24-6etch1_powerpc.deb
    Size/MD5 checksum:   449712 7e1abed25a0c2f6475709bc7c0e87311
  http://security.debian.org/pool/updates/main/s/samba/smbclient_3.0.24-6etch1_powerpc.deb
    Size/MD5 checksum:  4229306 0f8a9c2f8023fa2f0c6f3e964cea6327
  http://security.debian.org/pool/updates/main/s/samba/samba_3.0.24-6etch1_powerpc.deb
    Size/MD5 checksum:  3552136 85d3928828989f62e827e1195b727c9e
  http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.0.24-6etch1_powerpc.deb
    Size/MD5 checksum:   815718 034c2318ad76f4a7dda5b64c7d0db39b

s390 architecture (IBM S/390)

  http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.0.24-6etch1_s390.deb
    Size/MD5 checksum:   112082 15258a469aa6d1727fb51f6f1003857b
  http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.0.24-6etch1_s390.deb
    Size/MD5 checksum:   838852 518d3c64251d00414be3c4c961107ea5
  http://security.debian.org/pool/updates/main/s/samba/swat_3.0.24-6etch1_s390.deb
    Size/MD5 checksum:   843824 adbd5b2cdb20acde573aa41697e43495
  http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.0.24-6etch1_s390.deb
    Size/MD5 checksum: 12288702 434850ca8340de23c1581e6f0ecb258f
  http://security.debian.org/pool/updates/main/s/samba/winbind_3.0.24-6etch1_s390.deb
    Size/MD5 checksum:  2062906 fa37293fb98fcaf49da701be6bf7be60
  http://security.debian.org/pool/updates/main/s/samba/python-samba_3.0.24-6etch1_s390.deb
    Size/MD5 checksum:  6376522 dccbddd886e99d0d43672f612f2709b3
  http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.0.24-6etch1_s390.deb
    Size/MD5 checksum:   476980 bdf50a77207714ff5e7a05109180bc3e
  http://security.debian.org/pool/updates/main/s/samba/smbfs_3.0.24-6etch1_s390.deb
    Size/MD5 checksum:   458840 cd8b0e10214411f78b812ae81e65abd4
  http://security.debian.org/pool/updates/main/s/samba/samba-common_3.0.24-6etch1_s390.deb
    Size/MD5 checksum:  2557334 65ac639e305ce9ca04bb1842e55c6c3c
  http://security.debian.org/pool/updates/main/s/samba/samba_3.0.24-6etch1_s390.deb
    Size/MD5 checksum:  3563638 56cda1a9fb87dd7647f27951a0098047
  http://security.debian.org/pool/updates/main/s/samba/smbclient_3.0.24-6etch1_s390.deb
    Size/MD5 checksum:  4234808 53ea004c15be309f0962a2e7d97b7408


  These files will probably be moved into the stable distribution on
  its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFGSe4aYrVLjBFATsMRAlipAJ90wQxaic8vjhtU6QNa+N79EafvvwCbBhpy
nUFSk9kKJSWQywePdP75cm8=
=eZBl
-----END PGP SIGNATURE-----