Executive Summary

Summary
Title Samba regression
Informations
Name USN-460-2 First vendor Publication 2007-05-22
Vendor Ubuntu Last vendor Modification 2007-05-22
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:L/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score 7.2 Attack Range Local
Cvss Impact Score 10 Attack Complexity Low
Cvss Expoit Score 3.9 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

A security issue affects the following Ubuntu releases:

Ubuntu 7.04

This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the following package versions:

Ubuntu 7.04:
samba 3.0.24-2ubuntu1.2

In general, a standard system upgrade is sufficient to effect the necessary changes.

Details follow:

USN-460-1 fixed several vulnerabilities in Samba. The upstream changes for CVE-2007-2444 had an unexpected side-effect in Feisty. Shares configured with the "force group" option no longer behaved correctly. This update corrects the problem. We apologize for the inconvenience.

Original advisory details:

Paul Griffith and Andrew Hogue discovered that Samba did not fully drop
root privileges while translating SIDs. A remote authenticated user
could issue SMB operations during a small window of opportunity and gain
root privileges. (CVE-2007-2444)

Original Source

Url : http://www.ubuntu.com/usn/USN-460-2

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-269 Improper Privilege Management

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 3
Os 3
Os 2

OpenVAS Exploits

Date Description
2010-02-15 Name : Solaris Update for Samba 114685-15
File : nvt/gb_solaris_114685_15.nasl
2010-02-15 Name : Solaris Update for Samba 114684-15
File : nvt/gb_solaris_114684_15.nasl
2009-10-13 Name : Solaris Update for Samba 119758-16
File : nvt/gb_solaris_119758_16.nasl
2009-10-13 Name : Solaris Update for Samba 119757-16
File : nvt/gb_solaris_119757_16.nasl
2009-10-13 Name : Solaris Update for Samba 114685-14
File : nvt/gb_solaris_114685_14.nasl
2009-10-13 Name : Solaris Update for Samba 114684-14
File : nvt/gb_solaris_114684_14.nasl
2009-09-23 Name : Solaris Update for Samba 119757-15
File : nvt/gb_solaris_119757_15.nasl
2009-09-23 Name : Solaris Update for Samba 119758-15
File : nvt/gb_solaris_119758_15.nasl
2009-06-03 Name : Solaris Update for Samba 114684-13
File : nvt/gb_solaris_114684_13.nasl
2009-06-03 Name : Solaris Update for Samba 114685-13
File : nvt/gb_solaris_114685_13.nasl
2009-06-03 Name : Solaris Update for Samba 119757-14
File : nvt/gb_solaris_119757_14.nasl
2009-06-03 Name : Solaris Update for Samba 119758-14
File : nvt/gb_solaris_119758_14.nasl
2009-04-09 Name : Mandriva Update for samba MDKSA-2007:104 (samba)
File : nvt/gb_mandriva_MDKSA_2007_104.nasl
2009-04-09 Name : Mandriva Update for samba MDKSA-2007:104-1 (samba)
File : nvt/gb_mandriva_MDKSA_2007_104_1.nasl
2009-03-23 Name : Ubuntu Update for samba vulnerabilities USN-460-1
File : nvt/gb_ubuntu_USN_460_1.nasl
2009-03-23 Name : Ubuntu Update for samba regression USN-460-2
File : nvt/gb_ubuntu_USN_460_2.nasl
2009-02-27 Name : Fedora Update for samba FEDORA-2007-507
File : nvt/gb_fedora_2007_507_samba_fc6.nasl
2009-02-27 Name : Fedora Update for samba FEDORA-2007-506
File : nvt/gb_fedora_2007_506_samba_fc5.nasl
2009-01-28 Name : SuSE Update for samba SUSE-SA:2007:031
File : nvt/gb_suse_2007_031.nasl
2008-09-24 Name : Gentoo Security Advisory GLSA 200705-15 (samba)
File : nvt/glsa_200705_15.nasl
2008-09-04 Name : FreeBSD Ports: samba, ja-samba
File : nvt/freebsd_samba12.nasl
2008-01-17 Name : Debian Security Advisory DSA 1291-4 (samba)
File : nvt/deb_1291_4.nasl
2008-01-17 Name : Debian Security Advisory DSA 1291-3 (samba)
File : nvt/deb_1291_3.nasl
0000-00-00 Name : Slackware Advisory SSA:2007-134-01 samba
File : nvt/esoft_slk_ssa_2007_134_01.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
34698 Samba SID/Name Translation Privileged SMB/CIFS Protocol Operation Execution

Nessus® Vulnerability Scanner

Date Description
2007-11-10 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-460-1.nasl - Type : ACT_GATHER_INFO
2007-11-10 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-460-2.nasl - Type : ACT_GATHER_INFO
2007-10-17 Name : The remote openSUSE host is missing a security update.
File : suse_samba-3350.nasl - Type : ACT_GATHER_INFO
2007-05-20 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_3546a83303ea11dca51d0019b95d4f14.nasl - Type : ACT_GATHER_INFO
2007-05-16 Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2007-134-01.nasl - Type : ACT_GATHER_INFO
2007-05-16 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1291.nasl - Type : ACT_GATHER_INFO
2007-05-16 Name : The remote Fedora Core host is missing a security update.
File : fedora_2007-506.nasl - Type : ACT_GATHER_INFO
2007-05-16 Name : The remote Fedora Core host is missing a security update.
File : fedora_2007-507.nasl - Type : ACT_GATHER_INFO
2007-05-16 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200705-15.nasl - Type : ACT_GATHER_INFO
2007-05-16 Name : The remote Mandrake Linux host is missing one or more security updates.
File : mandrake_MDKSA-2007-104.nasl - Type : ACT_GATHER_INFO
2007-05-15 Name : The remote Samba server is affected by multiple vulnerabilities.
File : samba_3_0_25.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2014-02-17 12:04:22
  • Multiple Updates