New Samba exploit

(Traditional format)

Sat Dec 18 13:05:55 2004 New Samba exploit
Posted by Tony Lawrence
Search Keys: security
Referencing: http://cert.uni-stuttgart.de/archive/bugtraq/2004/12/msg00186.html

Patches from http://us2.samba.org/samba/ftp/patches/security/

This of course does require access to a share to begin with, and not too many folks expose shares to the big bad world. However, this could allow someone who had gained internal access through hacking a non-admin account to escalate their privilege and get root access to the Samba server, so it's important to patch this one.

It never ends, does it? And it is particularly galling to we Unixy folks because the only reason we have any Samba running at all is because we need it for the darn Microsoft machines. I think it's a fair observation that NFS wasn't much used in smaller Unix systems, but Network Neighborhood is everywhere.

It all goes back to "making it easy". The easier you make it for the users, the more places where a mistake like this can bite you.

Oh well, patch and get on with it, right?

Take Control of Sharing Files in Snow Leopard

Take Control of Users & Accounts in Snow Leopard

Jump to Comments

Many of the products and books I review are things I purchased for my own use. Some were given to me specifically for the purpose of reviewing them. I resell or can earn commissions from the sale of some of these items. Links within these pages may be affiliate links that pay me for referring you to them. That's mostly insignificant amounts of money; whenever it is not I have made my relationship plain. I also may own stock in companies mentioned here. If you have any question, please do feel free to contact me.

Specific links that take you to pages that allow you to purchase the item I reviewed are very likely to pay me a commission. Many of the books I review were given to me by the publishers specifically for the purpose of writing a review. These gifts and referral fees do not affect my opinions; I often give bad reviews anyway.

We use Google third-party advertising companies to serve ads when you visit our website. These companies may use information (not including your name, address, email address, or telephone number) about your visits to this and other websites in order to provide advertisements about goods and services of interest to you. If you would like more information about this practice and to know your choices about not having this information used by these companies, click here.