| Description: | Description:
The remote host is missing an update to samba
announced via advisory FEDORA-2008-4724.
Update Information:
Fix CVE-2008-1105 A heap-based buffer overflow flaw has been found in the way
Samba clients handle over-sized packets. If a client connected to a malicious
Samba server, it was possible to execute arbitrary code as the Samba client
user. The Samba server can also act as a client to perform some operations
(print notify, domain member vs domain controler ...). This could result in the
server executing the vulnerable client code, resulting in arbitrary code
execution with the permissions of the Samba server.
ChangeLog:
* Wed May 28 2008 Guenther Deschner - 3.2.0-1.rc1.14
- Add fix for CVE-2008-1105
- resolves: #446724
* Fri May 23 2008 Guenther Deschner - 3.2.0-1.rc1.13
- Update to 3.2.0rc1
* Wed May 21 2008 Simo Sorce - 3.2.0-1.pre3.12
- make it possible to print against Vista and XP SP3 as servers
- resolves: #439154
* Thu May 15 2008 Guenther Deschner - 3.2.0-1.pre3.11
- Add net ads join createcomputer=ou1/ou2/ou3 fix (BZO #5465)
* Fri May 9 2008 Guenther Deschner - 3.2.0-1.pre3.10
- Add smbclient fix (BZO #5452)
References:
[ 1 ] Bug #446724 - CVE-2008-1105 Samba client buffer overflow
https://bugzilla.redhat.com/show_bug.cgi?id=446724
Solution: Apply the appropriate updates.
This update can be installed with the yum update program. Use
su -c 'yum update samba' at the command line.
For more information, refer to Managing Software with yum,
available at http://docs.fedoraproject.org/yum/.
http://www.securityspace.com/smysecure/catid.html?in=FEDORA-2008-4724
Risk factor : High
CVSS Score:
7.5
|
