| Description: | Summary:
The remote host is missing an update for the 'samba' package(s) announced via the SSA:2007-134-01 advisory.
Vulnerability Insight:
New samba packages are available for Slackware 10.0, 10.1, 10.2, 11.0,
and -current to fix security issues.
More details about the issues may be found in the Common
Vulnerabilities and Exposures (CVE) database:
[links moved to references]
Here are the details from the Slackware 11.0 ChangeLog:
+--------------------------+
patches/packages/samba-3.0.25-i486-1_slack11.0.tgz:
Upgraded to samba-3.0.25.
Security Fixes included in the Samba 3.0.25 release are:
o CVE-2007-2444
Versions: Samba 3.0.23d - 3.0.25pre2
Local SID/Name translation bug can result in
user privilege elevation
o CVE-2007-2446
Versions: Samba 3.0.0 - 3.0.24
Multiple heap overflows allow remote code execution
o CVE-2007-2447
Versions: Samba 3.0.0 - 3.0.24
Unescaped user input parameters are passed as
arguments to /bin/sh allowing for remote command
execution
For more information, see:
[links moved to references]
(* Security fix *)
+--------------------------+
Affected Software/OS:
'samba' package(s) on Slackware 10.0, Slackware 10.1, Slackware 10.2, Slackware 11.0, Slackware current.
Solution:
Please install the updated package(s).
CVSS Score:
10.0
CVSS Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
|
