Test ID:	1.3.6.1.4.1.25623.1.0.67420
Category:	Mandrake Local Security Checks
Title:	Mandriva Security Advisory MDVSA-2010:090-1 (samba)
Summary:	NOSUMMARY
Description:	Description: The remote host is missing an update to samba announced via advisory MDVSA-2010:090-1. Multiple vulnerabilies has been found and corrected in samba: client/mount.cifs.c in mount.cifs in smbfs in Samba does not verify that the (1) device name and (2) mountpoint strings are composed of valid characters, which allows local users to cause a denial of service (mtab corruption) via a crafted string (CVE-2010-0547). client/mount.cifs.c in mount.cifs in smbfs in Samba allows local users to mount a CIFS share on an arbitrary mountpoint, and gain privileges, via a symlink attack on the mountpoint directory file (CVE-2010-0787). The updated packages have been patched to correct these issues. Update: It was discovered that the previous Samba update required libtalloc from Samba4 package. Therefore, this update provides the required packages in order to fix the issue. Affected: 2010.0 Solution: To upgrade automatically use MandrakeUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. http://www.securityspace.com/smysecure/catid.html?in=MDVSA-2010:090-1 Risk factor : Medium CVSS Score: 4.4
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2010-0547 BugTraq ID: 38326 http://www.securityfocus.com/bid/38326 http://security.gentoo.org/glsa/glsa-201206-29.xml http://www.mandriva.com/security/advisories?name=MDVSA-2010:090 http://secunia.com/advisories/39317 SuSE Security Announcement: SUSE-SR:2010:008 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.html SuSE Security Announcement: SUSE-SR:2010:014 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html http://www.vupen.com/english/advisories/2010/1062 Common Vulnerability Exposure (CVE) ID: CVE-2010-0787 BugTraq ID: 37992 http://www.securityfocus.com/bid/37992 BugTraq ID: 39898 http://www.securityfocus.com/bid/39898 http://lists.fedoraproject.org/pipermail/package-announce/2010-January/034444.html http://lists.fedoraproject.org/pipermail/package-announce/2010-January/034470.html http://secunia.com/advisories/38286 http://secunia.com/advisories/38308 http://secunia.com/advisories/38357 http://www.ubuntu.com/usn/USN-893-1 XForce ISS Database: sambaclient-mountcifs-symlink(55944) https://exchange.xforce.ibmcloud.com/vulnerabilities/55944
Copyright	Copyright (c) 2010 E-Soft Inc. http://www.securityspace.com

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.