From owner-freebsd-security Tue Mar 18 22:18:47 2003 Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 3063537B404 for ; Tue, 18 Mar 2003 22:18:44 -0800 (PST) Received: from cirb503493.alcatel.com.au (c18609.belrs1.nsw.optusnet.com.au [210.49.80.204]) by mx1.FreeBSD.org (Postfix) with ESMTP id 065C543F93 for ; Tue, 18 Mar 2003 22:18:42 -0800 (PST) (envelope-from peterjeremy@optushome.com.au) Received: from cirb503493.alcatel.com.au (localhost.alcatel.com.au [127.0.0.1]) by cirb503493.alcatel.com.au (8.12.8/8.12.8) with ESMTP id h2J6ITM2004257; Wed, 19 Mar 2003 17:18:29 +1100 (EST) (envelope-from jeremyp@cirb503493.alcatel.com.au) Received: (from jeremyp@localhost) by cirb503493.alcatel.com.au (8.12.8/8.12.8/Submit) id h2J6IR27004256; Wed, 19 Mar 2003 17:18:27 +1100 (EST) Date: Wed, 19 Mar 2003 17:18:27 +1100 From: Peter Jeremy To: "Nikolaj I. Potanin" Cc: security@FreeBSD.ORG Subject: Re: Samba vulnerability Message-ID: <20030319061826.GA4238@cirb503493.alcatel.com.au> References: <20030318143759.GA77729@nevermind.kiev.ua> <3E774C85.902@drweb.ru> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <3E774C85.902@drweb.ru> User-Agent: Mutt/1.4i Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org On Tue, Mar 18, 2003 at 07:42:45PM +0300, Nikolaj I. Potanin wrote: >>A flaw has been detected in the Samba main smbd code which could allow >>an external attacker to remotely and anonymously gain Super User (root) > ^^^^^^^^^^^^^^^^^ > >Does anyone here have smbd bound to an external interface? ;-) I read this as "external to the Samba server" - which covers everyone who installs Samba in a usable system. If you read it as an Internet accessible server then this is a lot risker - but remember that some people offer NFS across the Internet so it's within the realm of possibility that someone would want to offer Samba on the Internet. Peter To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message