869af6a3d7
This is a security release in order to address CVE-2009-2813, CVE-2009-2948
and CVE-2009-2906.
Please note that Samba 3.0 is not maintained any longer. This security
release is shipped on a voluntary basis.
o CVE-2009-2813:
In all versions of Samba later than 3.0.11, connecting to the home
share of a user will use the root of the filesystem
as the home directory if this user is misconfigured to have
an empty home directory in /etc/passwd.
o CVE-2009-2948:
If mount.cifs is installed as a setuid program, a user can pass it a
credential or password path to which he or she does not have access and
then use the --verbose option to view the first line of that file.
o CVE-2009-2906:
Specially crafted SMB requests on authenticated SMB connections can
send smbd into a 100% CPU loop, causing a DoS on the Samba server.
13 lines
461 B
Text
13 lines
461 B
Text
$NetBSD: patch-ci,v 1.1 2009/10/04 16:58:38 taca Exp $
|
|
|
|
--- libsmb/samlogon_cache.c.orig 2009-09-30 21:21:56.000000000 +0900
|
|
+++ libsmb/samlogon_cache.c
|
|
@@ -34,7 +34,7 @@ static TDB_CONTEXT *netsamlogon_tdb = NU
|
|
BOOL netsamlogon_cache_init(void)
|
|
{
|
|
if (!netsamlogon_tdb) {
|
|
- netsamlogon_tdb = tdb_open_log(lock_path(NETSAMLOGON_TDB), 0,
|
|
+ netsamlogon_tdb = tdb_open_log(state_path(NETSAMLOGON_TDB), 0,
|
|
TDB_DEFAULT, O_RDWR | O_CREAT, 0600);
|
|
}
|
|
|