FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The last vuln.xml file processed by FreshPorts is:

Revision:  496547
Date:      2019-03-22
Time:      04:08:55Z
Committer: zeising

List all Vulnerabilities, by package

List all Vulnerabilities, by date

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
2bc96f18-683f-11dc-82b6-02e0185f8d72samba -- nss_info plugin privilege escalation vulnerability

The Samba development team reports:

The library provides an nss_info extension to Winbind for retrieving a user's home directory path, login shell and primary group id from an Active Directory domain controller. This functionality is enabled by defining the "winbind nss info" smb.conf option to either "sfu" or "rfc2307".

Both the Windows "Identity Management for Unix" and "Services for Unix" MMC plug-ins allow a user to be assigned a primary group for Unix clients that differs from the user's Windows primary group. When the rfc2307 or sfu nss_info plugin has been enabled, in the absence of either the RFC2307 or SFU primary group attribute, Winbind will assign a primary group ID of 0 to the domain user queried using the getpwnam() C library call.

Discovery 2007-09-11
Entry 2007-09-21
Modified 2008-09-26
lt 3.0.26a

gt *,1 lt 3.0.26a,1

ffcbd42d-a8c5-11dc-bec2-02e0185f8d72samba -- buffer overflow vulnerability

Secuna Research reports:

Secunia Research has discovered a vulnerability in Samba, which can be exploited by malicious people to compromise a vulnerable system. The vulnerability is caused due to a boundary error within the "send_mailslot()" function. This can be exploited to cause a stack-based buffer overflow with zero bytes via a specially crafted "SAMLOGON" domain logon packet containing a username string placed at an odd offset followed by an overly long GETDC string. Successful exploitation allows execution of arbitrary code, but requires that the "domain logons" option is enabled.

Discovery 2007-12-10
Entry 2007-12-12
Modified 2008-09-26
lt 3.0.28

gt *,1 lt 3.0.28,1

a63b15f9-97ff-11dc-9e48-0016179b2dd5samba -- multiple vulnerabilities

The Samba Team reports:

Secunia Research reported a vulnerability that allows for the execution of arbitrary code in nmbd. This defect may only be exploited when the "wins support" parameter has been enabled in smb.conf.

Samba developers have discovered what is believed to be a non-exploitable buffer over in nmbd during the processing of GETDC logon server requests. This code is only used when the Samba server is configured as a Primary or Backup Domain Controller.

Discovery 2007-11-15
Entry 2007-11-21
Modified 2008-09-26
lt 3.0.26a

gt *,1 lt 3.0.26a_2,1