A vulnerability has been discovered and corrected in samba :

Samba versions 3.0.x, 3.2.x and 3.3.x are affected by a memory corruption vulnerability. Code dealing with the chaining of SMB1 packets did not correctly validate an input field provided by the client, making it possible for a specially crafted packet to crash the server or potentially cause the server to execute arbitrary code (CVE-2010-2063).

Packages for 2008.0 and 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&amp;products_id=4 90

The updated packages have been patched to correct this issue.

Updated samba and samba3x packages that fix one security issue are now available for Red Hat Enterprise Linux 3, 4, and 5, and Red Hat Enterprise Linux 4.7, 5.3, and 5.4 Extended Update Support.

The Red Hat Security Response Team has rated this update as having critical security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Samba is a suite of programs used by machines to share files, printers, and other information.

An input sanitization flaw was found in the way Samba parsed client data. A malicious client could send a specially crafted SMB packet to the Samba server, resulting in arbitrary code execution with the privileges of the Samba server (smbd). (CVE-2010-2063)

Red Hat would like to thank the Samba team for responsibly reporting this issue. Upstream acknowledges Jun Mao as the original reporter.

Users of Samba are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue. After installing this update, the smb service will be restarted automatically.

An input sanitization flaw was found in the way Samba parsed client data. A malicious client could send a specially crafted SMB packet to the Samba server, resulting in arbitrary code execution with the privileges of the Samba server (smbd). (CVE-2010-2063)

After installing this update, the smb service will be restarted automatically.

New samba packages are available for Slackware 10.0, 10.1, 10.2, 11.0, 12.0, 12.1, 12.2, and 13.0 to fix a security issue.

The remote host is affected by the vulnerability described in GLSA-201206-22 (Samba: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Samba. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with root       privileges, cause a Denial of Service condition, take ownership of shared       files, or bypass file permissions. Furthermore, a local attacker may be       able to cause a Denial of Service condition or obtain sensitive       information in a Samba credentials file.
  Workaround :

    There is no known workaround at this time.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
47042	Mandriva Linux Security Advisory : samba (MDVSA-2010:119)	Nessus	Mandriva Local Security Checks	2010/6/18	2021/1/6	high
47034	RHEL 3 / 4 / 5 : samba and samba3x (RHSA-2010:0488)	Nessus	Red Hat Local Security Checks	2010/6/17	2021/1/14	high
60804	Scientific Linux Security Update : samba and samba3x on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high
60805	Scientific Linux Security Update : samba on SL3.x, SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high
47047	Slackware 10.0 / 10.1 / 10.2 / 11.0 / 12.0 / 12.1 / 12.2 / 13.0 : samba (SSA:2010-169-01)	Nessus	Slackware Local Security Checks	2010/6/20	2021/1/14	high
47101	CentOS 3 / 4 / 5 : samba / samba3x (CESA-2010:0488)	Nessus	CentOS Local Security Checks	2010/6/21	2021/1/4	high
59675	GLSA-201206-22 : Samba: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2012/6/25	2021/1/6	critical

检测

插件搜索

high

high

high

high

high

high

critical