Test ID:	1.3.6.1.4.1.25623.1.0.54044
Category:	SuSE Local Security Checks
Title:	SuSE Security Advisory SUSE-SA:2004:035 (samba)
Summary:	NOSUMMARY
Description:	Description: The remote host is missing updates announced in advisory SUSE-SA:2004:035. The Samba server, which allows to share files and resources via the SMB/CIFS protocol, contains a bug in the sanitation code of path names which allows remote attackers to access files outside of the defined share. In order to access these files, they must be readable by the account used for the SMB session. CVE-2004-0815 has been assigned to this issue. Solution: Update your system with the packages as indicated in the referenced security advisory. http://www.securityspace.com/smysecure/catid.html?in=SUSE-SA:2004:035 Risk factor : Critical CVSS Score: 10.0
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2004-0815 BugTraq ID: 11281 http://www.securityfocus.com/bid/11281 Bugtraq: 20040930 Samba Security Announcement -- Potential Arbitrary File Access (Google Search) http://marc.info/?l=bugtraq&m=109655827913457&w=2 Bugtraq: 20041005 ERRATA: Potential Arbitrary File Access (CAN-2004-0815) (Google Search) http://www.securityfocus.com/archive/1/377618 Conectiva Linux advisory: CLA-2004:873 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000873 Debian Security Information: DSA-600 (Google Search) http://www.debian.org/security/2004/dsa-600 https://bugzilla.fedora.us/show_bug.cgi?id=2102 http://www.idefense.com/application/poi/display?id=146&type=vulnerabilities&flashstatus=true http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:104 http://www.redhat.com/support/errata/RHSA-2004-498.html http://sunsolve.sun.com/search/document.do?assetkey=1-26-101584-1 http://sunsolve.sun.com/search/document.do?assetkey=1-66-200529-1 http://sunsolve.sun.com/search/document.do?assetkey=1-26-57664-1 SuSE Security Announcement: SUSE-SA:2004:035 (Google Search) http://www.novell.com/linux/security/advisories/2004_35_samba.html http://www.trustix.org/errata/2004/0051/ XForce ISS Database: samba-file-access(17556) https://exchange.xforce.ibmcloud.com/vulnerabilities/17556 Common Vulnerability Exposure (CVE) ID: CVE-2004-0691 Bugtraq: 20040818 CESA-2004-004: qt (Google Search) http://marc.info/?l=bugtraq&m=109295309008309&w=2 Debian Security Information: DSA-542 (Google Search) http://www.debian.org/security/2004/dsa-542 http://security.gentoo.org/glsa/glsa-200408-20.xml http://www.mandriva.com/security/advisories?name=MDKSA-2004:085 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9485 http://www.redhat.com/support/errata/RHSA-2004-414.html http://sunsolve.sun.com/search/document.do?assetkey=1-66-201610-1 SuSE Security Announcement: SUSE-SA:2004:027 (Google Search) http://www.novell.com/linux/security/advisories/2004_27_qt3.html XForce ISS Database: qt-bmp-bo(17040) https://exchange.xforce.ibmcloud.com/vulnerabilities/17040 Common Vulnerability Exposure (CVE) ID: CVE-2004-0597 http://lists.apple.com/mhonarc/security-announce/msg00056.html BugTraq ID: 10857 http://www.securityfocus.com/bid/10857 BugTraq ID: 15495 http://www.securityfocus.com/bid/15495 Bugtraq: 20040804 [OpenPKG-SA-2004.035] OpenPKG Security Advisory (png) (Google Search) http://marc.info/?l=bugtraq&m=109163866717909&w=2 Bugtraq: 20050209 MSN Messenger PNG Image Buffer Overflow Download Shellcoded Exploit (Google Search) http://marc.info/?l=bugtraq&m=110796779903455&w=2 Cert/CC Advisory: TA04-217A http://www.us-cert.gov/cas/techalerts/TA04-217A.html Cert/CC Advisory: TA05-039A http://www.us-cert.gov/cas/techalerts/TA05-039A.html CERT/CC vulnerability note: VU#388984 http://www.kb.cert.org/vuls/id/388984 CERT/CC vulnerability note: VU#817368 http://www.kb.cert.org/vuls/id/817368 Conectiva Linux advisory: CLA-2004:856 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000856 Debian Security Information: DSA-536 (Google Search) http://www.debian.org/security/2004/dsa-536 https://bugzilla.fedora.us/show_bug.cgi?id=1943 http://marc.info/?l=bugtraq&m=109900315219363&w=2 http://www.gentoo.org/security/en/glsa/glsa-200408-03.xml http://www.gentoo.org/security/en/glsa/glsa-200408-22.xml HPdes Security Advisory: SSRT4778 http://marc.info/?l=bugtraq&m=109181639602978&w=2 http://www.mandriva.com/security/advisories?name=MDKSA-2004:079 http://www.mandriva.com/security/advisories?name=MDKSA-2006:212 http://www.mandriva.com/security/advisories?name=MDKSA-2006:213 http://scary.beasts.org/security/CESA-2004-001.txt http://www.coresecurity.com/common/showdoc.php?idx=421&idxseccion=10 Microsoft Security Bulletin: MS05-009 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-009 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11284 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2274 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2378 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4492 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A594 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7709 http://www.redhat.com/support/errata/RHSA-2004-402.html http://www.redhat.com/support/errata/RHSA-2004-421.html http://www.redhat.com/support/errata/RHSA-2004-429.html SCO Security Bulletin: SCOSA-2004.16 http://marc.info/?l=bugtraq&m=109761239318458&w=2 SCO Security Bulletin: SCOSA-2005.49 ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt http://secunia.com/advisories/22957 http://secunia.com/advisories/22958 http://sunsolve.sun.com/search/document.do?assetkey=1-66-200663-1 SuSE Security Announcement: SUSE-SA:2004:023 (Google Search) http://www.novell.com/linux/security/advisories/2004_23_libpng.html http://www.trustix.net/errata/2004/0040/ XForce ISS Database: libpng-pnghandle-bo(16894) https://exchange.xforce.ibmcloud.com/vulnerabilities/16894 Common Vulnerability Exposure (CVE) ID: CVE-2004-0598 CERT/CC vulnerability note: VU#236656 http://www.kb.cert.org/vuls/id/236656 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10203 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2572 XForce ISS Database: libpng-pnghandleiccp-dos(16895) https://exchange.xforce.ibmcloud.com/vulnerabilities/16895 Common Vulnerability Exposure (CVE) ID: CVE-2004-0599 CERT/CC vulnerability note: VU#160448 http://www.kb.cert.org/vuls/id/160448 CERT/CC vulnerability note: VU#286464 http://www.kb.cert.org/vuls/id/286464 CERT/CC vulnerability note: VU#477512 http://www.kb.cert.org/vuls/id/477512 Debian Security Information: DSA-570 (Google Search) http://www.debian.org/security/2004/dsa-570 Debian Security Information: DSA-571 (Google Search) http://www.debian.org/security/2004/dsa-571 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10938 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1479 XForce ISS Database: lilbpng-integer-bo(16896) https://exchange.xforce.ibmcloud.com/vulnerabilities/16896 Common Vulnerability Exposure (CVE) ID: CVE-2004-0746 BugTraq ID: 10991 http://www.securityfocus.com/bid/10991 Bugtraq: 20040823 KDE Security Advisory: Konqueror Cross-Domain Cookie Injection (Google Search) http://marc.info/?l=bugtraq&m=109327681304401&w=2 Conectiva Linux advisory: CLA-2004:864 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000864 http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:086 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11281 http://secunia.com/advisories/12341 XForce ISS Database: kde-konqueror-cookie-set(17063) https://exchange.xforce.ibmcloud.com/vulnerabilities/17063 Common Vulnerability Exposure (CVE) ID: CVE-2004-0718 Debian Security Information: DSA-777 (Google Search) http://www.debian.org/security/2005/dsa-777 Debian Security Information: DSA-810 (Google Search) http://www.debian.org/security/2005/dsa-810 http://www.mandriva.com/security/advisories?name=MDKSA-2004:082 http://secunia.com/multiple_browsers_frame_injection_vulnerability_test/ https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4756 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9997 http://secunia.com/advisories/11978 SuSE Security Announcement: SUSE-SA:2004:036 (Google Search) http://www.novell.com/linux/security/advisories/2004_36_mozilla.html XForce ISS Database: http-frame-spoof(1598) https://exchange.xforce.ibmcloud.com/vulnerabilities/1598 Common Vulnerability Exposure (CVE) ID: CVE-2004-0722 http://www.idefense.com/application/poi/display?id=117&type=vulnerabilities https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4629 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9378 XForce ISS Database: mozilla-netscape-soapparameter-bo(16862) https://exchange.xforce.ibmcloud.com/vulnerabilities/16862 Common Vulnerability Exposure (CVE) ID: CVE-2004-0757 CERT/CC vulnerability note: VU#561022 http://www.kb.cert.org/vuls/id/561022 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11042 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3250 http://secunia.com/advisories/10856 XForce ISS Database: mozilla-senduidl-pop3-bo(16869) https://exchange.xforce.ibmcloud.com/vulnerabilities/16869 Common Vulnerability Exposure (CVE) ID: CVE-2004-0758 CERT/CC vulnerability note: VU#784278 http://www.kb.cert.org/vuls/id/784278 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10304 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3134 XForce ISS Database: mozilla-certificate-dos(16706) https://exchange.xforce.ibmcloud.com/vulnerabilities/16706 Common Vulnerability Exposure (CVE) ID: CVE-2004-0759 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11153 XForce ISS Database: mozilla-warning-file-upload(16870) https://exchange.xforce.ibmcloud.com/vulnerabilities/16870 Common Vulnerability Exposure (CVE) ID: CVE-2004-0760 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11090 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1227 XForce ISS Database: mozilla-modify-mime-type(16691) https://exchange.xforce.ibmcloud.com/vulnerabilities/16691 Common Vulnerability Exposure (CVE) ID: CVE-2004-0761 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3603 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9240 XForce ISS Database: mozilla-redirect-ssl-spoof(16871) https://exchange.xforce.ibmcloud.com/vulnerabilities/16871 Common Vulnerability Exposure (CVE) ID: CVE-2004-0762 http://archives.neohapsis.com/archives/fulldisclosure/2004-07/0264.html http://www.squarefree.com/2004/07/01/race-conditions-in-security-dialogs/ https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10032 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4403 http://secunia.com/advisories/11999/ XForce ISS Database: mozilla-dialog-code-execution(16623) https://exchange.xforce.ibmcloud.com/vulnerabilities/16623 Common Vulnerability Exposure (CVE) ID: CVE-2004-0763 Bugtraq: 20040726 Mozilla Firefox Certificate Spoofing (Google Search) http://marc.info/?l=bugtraq&m=109087067730938&w=2 http://lists.grok.org.uk/pipermail/full-disclosure/2004-July/024372.html http://www.cipher.org.uk/index.php?p=advisories/Certificate_Spoofing_Mozilla_FireFox_25-07-2004.advisory https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3989 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9436 http://secunia.com/advisories/12160/ XForce ISS Database: mozilla-ssl-certificate-spoofing(16796) https://exchange.xforce.ibmcloud.com/vulnerabilities/16796 Common Vulnerability Exposure (CVE) ID: CVE-2004-0764 BugTraq ID: 10832 http://www.securityfocus.com/bid/10832 CERT/CC vulnerability note: VU#262350 http://www.kb.cert.org/vuls/id/262350 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2418 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9419 http://secunia.com/advisories/12188 XForce ISS Database: mozilla-user-interface-spoofing(16837) https://exchange.xforce.ibmcloud.com/vulnerabilities/16837 Common Vulnerability Exposure (CVE) ID: CVE-2004-0765 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11162 XForce ISS Database: mozilla-certtesthostname-certificate-spoof(16868) https://exchange.xforce.ibmcloud.com/vulnerabilities/16868
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.