From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from lists.gentoo.org ([140.105.134.102] helo=robin.gentoo.org) by nuthatch.gentoo.org with esmtp (Exim 4.62) (envelope-from ) id 1HPoO5-0002m8-Mf for garchives@archives.gentoo.org; Fri, 09 Mar 2007 23:20:38 +0000 Received: from robin.gentoo.org (localhost [127.0.0.1]) by robin.gentoo.org (8.14.0/8.14.0) with SMTP id l29NIDg1007946; Fri, 9 Mar 2007 23:18:13 GMT Received: from mx1.falcal.net (falco.bz [88.162.192.139]) by robin.gentoo.org (8.14.0/8.14.0) with ESMTP id l29Mrc1p006431 for ; Fri, 9 Mar 2007 22:53:38 GMT Received: by mx1.falcal.net (Postfix, from userid 1000) id D873815843C; Fri, 9 Mar 2007 23:53:37 +0100 (CET) Date: Fri, 9 Mar 2007 23:53:37 +0100 From: Raphael Marichez To: gentoo-announce@gentoo.org Cc: bugtraq@securityfocus.com, full-disclosure@lists.grok.org.uk, security-alerts@linuxsecurity.com Subject: [gentoo-announce] [ GLSA 200703-09 ] Smb4K: Multiple vulnerabilities Message-ID: <20070309225337.GE8086@falco.falcal.net> Mail-Followup-To: gentoo-announce@gentoo.org, bugtraq@securityfocus.com, full-disclosure@lists.grok.org.uk, security-alerts@linuxsecurity.com Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-announce@gentoo.org MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="CblX+4bnyfN0pR09" Content-Disposition: inline X-Web: http://falco.bz/ X-GPG-fingerprint: 04EB 153A 6B28 3E80 87A9 9B4F A77C 4BDE 021C 5BD2 X-GPG-Key: http://subkeys.pgp.net:11371/pks/lookup?op=get&search=0x021C5BD2 X-GPG-Subkey: http://subkeys.pgp.net:11371/pks/lookup?op=get&search=0x0114FC45 Organization: Gentoo Linux Security Team User-Agent: mutt-ng/devel-r804 (Linux) X-Archives-Salt: 63f177d4-c8f5-4e01-baf5-4324f6c92be7 X-Archives-Hash: 80240f0cdb2a6641850695978c778e7e --CblX+4bnyfN0pR09 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200703-09 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: Smb4K: Multiple vulnerabilities Date: March 09, 2007 Bugs: #156152 ID: 200703-09 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been identified in Smb4K. Background ========== Smb4K is a SMB/CIFS (Windows) share browser for KDE. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-misc/smb4k < 0.6.10a >= 0.6.10a Description =========== Kees Cook of the Ubuntu Security Team has identified multiple vulnerabilities in Smb4K. * The writeFile() function of smb4k/core/smb4kfileio.cpp makes insecure usage of temporary files. * The writeFile() function also stores the contents of the sudoers file with incorrect permissions, allowing for the file's contents to be world-readable. * The createLockFile() and removeLockFile() functions improperly handle lock files, possibly allowing for a race condition in file handling. * The smb4k_kill utility distributed with Smb4K allows any user in the sudoers group to kill any process on the system. * Lastly, there is the potential for multiple stack overflows when any Smb4K utility is used with the sudo command. Impact ====== A local attacker could gain unauthorized access to arbitrary files via numerous attack vectors. In some cases to obtain this unauthorized access, an attacker would have to be a member of the sudoers list. Workaround ========== There is no known workaround at this time. Resolution ========== All Smb4K users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/smb4k-0.6.10a" References ========== [ 1 ] CVE-2007-0472 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0472 [ 2 ] CVE-2007-0473 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0473 [ 3 ] CVE-2007-0474 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0474 [ 4 ] CVE-2007-0475 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0475 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200703-09.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at http://bugs.gentoo.org. License ======= Copyright 2007 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 --CblX+4bnyfN0pR09 Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) iQEVAwUBRfHlcTvRww8BFPxFAQIM5Af+Imku1bB+wcNPzpiWOnGQ1zZ3ztpmpJdl babUS5sTVWA9C/5H1IPFkuJN3Ha2AsZI1Qzipvr5BhblwHoQMIzrBQki/cxGjLgk /EReiQUx4tQCteLD4RiQ+htkf+OD1xDOvkjXSjTK3Y55l9qjXkDxER6n5nnQ7tvp gRYng+Ln9z9hpOCjudSxrknRb+iiKohsTfenIcRB0NgEr9TeYmQ78MdkP7XrrpeY rjh6unkYUpAwtdJ8tuMkrjtxcNLyiyUo64JO5BQ2+NoNx/8KsQjs4BqdNDrHOELB CA9o8tAvgYfj2WRVWgglfXMTFi8pvzdkXibw9DL9x/ZPIi22V6MhGQ== =Omrz -----END PGP SIGNATURE----- --CblX+4bnyfN0pR09-- -- gentoo-announce@gentoo.org mailing list