Test ID:	1.3.6.1.4.1.25623.1.0.70262
Category:	FreeBSD Local Security Checks
Title:	FreeBSD Ports: samba34
Summary:	FreeBSD Ports: samba34
Description:	The remote host is missing an update to the system as announced in the referenced advisory. The following packages are affected: samba34 samba35 CVE-2011-2522 Multiple cross-site request forgery (CSRF) vulnerabilities in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.10 allow remote attackers to hijack the authentication of administrators for requests that (1) shut down daemons, (2) start daemons, (3) add shares, (4) remove shares, (5) add printers, (6) remove printers, (7) add user accounts, or (8) remove user accounts, as demonstrated by certain start, stop, and restart parameters to the status program. CVE-2011-2694 Cross-site scripting (XSS) vulnerability in the chg_passwd function in web/swat.c in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.10 allows remote authenticated administrators to inject arbitrary web script or HTML via the username parameter to the passwd program (aka the user field to the Change Password page). Solution: Update your system with the appropriate patches or software upgrades.
Cross-Ref:	BugTraq ID: 48901 BugTraq ID: 48899 Common Vulnerability Exposure (CVE) ID: CVE-2011-2522 http://www.exploit-db.com/exploits/17577 Debian Security Information: DSA-2290 (Google Search) http://www.debian.org/security/2011/dsa-2290 HPdes Security Advisory: HPSBNS02701 http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c03008543 HPdes Security Advisory: SSRT100598 http://www.mandriva.com/security/advisories?name=MDVSA-2011:121 http://ubuntu.com/usn/usn-1182-1 http://jvn.jp/en/jp/JVN29529126/index.html http://www.securityfocus.com/bid/48899 http://osvdb.org/74071 http://securitytracker.com/id?1025852 http://secunia.com/advisories/45393 http://secunia.com/advisories/45488 http://secunia.com/advisories/45496 http://securityreason.com/securityalert/8317 XForce ISS Database: samba-swat-csrf(68843) http://xforce.iss.net/xforce/xfdb/68843 Common Vulnerability Exposure (CVE) ID: CVE-2011-2694 http://jvn.jp/en/jp/JVN63041502/index.html http://www.securityfocus.com/bid/48901 http://osvdb.org/74072 XForce ISS Database: samba-user-xss(68844) http://xforce.iss.net/xforce/xfdb/68844
Copyright	Copyright (c) 2011 E-Soft Inc. http://www.securityspace.com

This is only one of 32582 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.

New User Registration Email: UserID: Passwd: Please email me your monthly newsletters, informing the latest services, improvements & surveys. Please email me a vulnerability test announcement whenever a new test is added.     Privacy

Registered User Login   UserID:     Passwd:     Forgot userid or passwd? Email/Userid: