: Log in!


ウェブ 検索
トップ  >  Linux13歩  >  2013-11-12 sambaのupdate
20131112 samba-3.6.20にupdateしました

Release Notes for Samba 3.6.20 November 11, 2013

This is a security release in order to address
CVE-2013-4475 (ACLs are not checked on opening an alternate
data stream on a file or directory).

. CVE-2013-4475:
  Samba versions 3.2.0 and above (all versions of 3.2.x, 3.3.x,
  3.4.x, 3.5.x, 3.6.x, 4.0.x and 4.1.x) do not check the underlying
  file or directory ACL when opening an alternate data stream.

  According to the SMB1 and SMB2+ protocols the ACL on an underlying
  file or directory should control what access is allowed to alternate
  data streams that are associated with the file or directory.

  By default no version of Samba supports alternate data streams
  on files or directories.

  Samba can be configured to support alternate data streams by loading
  either one of two virtual file system modues (VFS) vfs_streams_depot or
  vfs_streams_xattr supplied with Samba, so this bug only affects Samba
  servers configured this way.

  To determine if your server is vulnerable, check for the strings
  "streams_depot" or "streams_xattr" inside your smb.conf configuration

Changes since 3.6.19:

. Jeremy Allison <jra at samba.org>
  * BUGs 10234 + 10229: CVE-2013-4475: Fix access check verification on stream
投票数:37 平均点:4.05
2013-11-11 lynisのupdate
2013-11-20 dovecotのupdate