FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The last vuln.xml file processed by FreshPorts is:

Revision:  496343
Date:      2019-03-20
Time:      14:04:46Z
Committer: mfechner

List all Vulnerabilities, by package

List all Vulnerabilities, by date

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
f235fe7a-b9ca-11db-bf0f-0013720b182dsamba -- potential Denial of Service bug in smbd

The Samba Team reports:

Internally Samba's file server daemon, smbd, implements support for deferred file open calls in an attempt to serve client requests that would otherwise fail due to a share mode violation. When renaming a file under certain circumstances it is possible that the request is never removed from the deferred open queue. smbd will then become stuck is a loop trying to service the open request.

This bug may allow an authenticated user to exhaust resources such as memory and CPU on the server by opening multiple CIFS sessions, each of which will normally spawn a new smbd process, and sending each connection into an infinite loop.


Discovery 2007-02-05
Entry 2007-03-16
samba
ja-samba
ge 3.0.6,1 lt 3.0.24,1

CVE-2007-0452
http://www.samba.org/samba/security/CVE-2007-0452.html
3546a833-03ea-11dc-a51d-0019b95d4f14samba -- multiple vulnerabilities

The Samba Team reports:

A bug in the local SID/Name translation routines may potentially result in a user being able to issue SMB/CIFS protocol operations as root.

When translating SIDs to/from names using Samba local list of user and group accounts, a logic error in the smbd daemon's internal security stack may result in a transition to the root user id rather than the non-root user. The user is then able to temporarily issue SMB/CIFS protocol operations as the root user. This window of opportunity may allow the attacker to establish additional means of gaining root access to the server.

Various bugs in Samba's NDR parsing can allow a user to send specially crafted MS-RPC requests that will overwrite the heap space with user defined data.

Unescaped user input parameters are passed as arguments to /bin/sh allowing for remote command execution.

This bug was originally reported against the anonymous calls to the SamrChangePassword() MS-RPC function in combination with the "username map script" smb.conf option (which is not enabled by default).

After further investigation by Samba developers, it was determined that the problem was much broader and impacts remote printer and file share management as well. The root cause is passing unfiltered user input provided via MS-RPC calls to /bin/sh when invoking externals scripts defined in smb.conf. However, unlike the "username map script" vulnerability, the remote file and printer management scripts require an authenticated user session.


Discovery 2007-05-14
Entry 2007-05-16
Modified 2008-09-26
samba
ja-samba
gt 3.* lt 3.0.25

gt 3.*,1 lt 3.0.25,1

CVE-2007-2444
CVE-2007-2446
CVE-2007-2447
http://de5.samba.org/samba/security/CVE-2007-2444.html
http://de5.samba.org/samba/security/CVE-2007-2446.html
http://de5.samba.org/samba/security/CVE-2007-2447.html
57ae52f7-b9cc-11db-bf0f-0013720b182dsamba -- format string bug in afsacl.so VFS plugin

The Samba Team reports:

NOTE: This security advisory only impacts Samba servers that share AFS file systems to CIFS clients and which have been explicitly instructed in smb.conf to load the afsacl.so VFS module.

The source defect results in the name of a file stored on disk being used as the format string in a call to snprintf(). This bug becomes exploitable only when a user is able to write to a share which utilizes Samba's afsacl.so library for setting Windows NT access control lists on files residing on an AFS file system.


Discovery 2007-02-05
Entry 2007-03-16
samba
ja-samba
ge 3.0.6,1 lt 3.0.24,1

CVE-2007-0454
http://www.samba.org/samba/security/CVE-2007-0454.html
2bc96f18-683f-11dc-82b6-02e0185f8d72samba -- nss_info plugin privilege escalation vulnerability

The Samba development team reports:

The idmap_ad.so library provides an nss_info extension to Winbind for retrieving a user's home directory path, login shell and primary group id from an Active Directory domain controller. This functionality is enabled by defining the "winbind nss info" smb.conf option to either "sfu" or "rfc2307".

Both the Windows "Identity Management for Unix" and "Services for Unix" MMC plug-ins allow a user to be assigned a primary group for Unix clients that differs from the user's Windows primary group. When the rfc2307 or sfu nss_info plugin has been enabled, in the absence of either the RFC2307 or SFU primary group attribute, Winbind will assign a primary group ID of 0 to the domain user queried using the getpwnam() C library call.


Discovery 2007-09-11
Entry 2007-09-21
Modified 2008-09-26
samba
lt 3.0.26a

gt *,1 lt 3.0.26a,1

CVE-2007-4138
http://www.samba.org/samba/security/CVE-2007-4138.html
b168ddea-105a-11db-ac96-000c6ec775d9samba -- memory exhaustion DoS in smbd

The Samba Team reports:

The smbd daemon maintains internal data structures used track active connections to file and printer shares. In certain circumstances an attacker may be able to continually increase the memory usage of an smbd process by issuing a large number of share connection requests. This defect affects all Samba configurations.


Discovery 2006-07-10
Entry 2006-07-10
samba
ja-samba
ge 3.0.1,1 lt 3.0.23,1

CVE-2006-3403
http://www.samba.org/samba/security/CAN-2006-3403.html
57ae52f7-b9cc-11db-bf0f-0013720b182dsamba -- format string bug in afsacl.so VFS plugin

The Samba Team reports:

NOTE: This security advisory only impacts Samba servers that share AFS file systems to CIFS clients and which have been explicitly instructed in smb.conf to load the afsacl.so VFS module.

The source defect results in the name of a file stored on disk being used as the format string in a call to snprintf(). This bug becomes exploitable only when a user is able to write to a share which utilizes Samba's afsacl.so library for setting Windows NT access control lists on files residing on an AFS file system.


Discovery 2007-02-05
Entry 2007-03-16
samba
ja-samba
ge 3.0.6,1 lt 3.0.24,1

CVE-2007-0454
http://www.samba.org/samba/security/CVE-2007-0454.html
f235fe7a-b9ca-11db-bf0f-0013720b182dsamba -- potential Denial of Service bug in smbd

The Samba Team reports:

Internally Samba's file server daemon, smbd, implements support for deferred file open calls in an attempt to serve client requests that would otherwise fail due to a share mode violation. When renaming a file under certain circumstances it is possible that the request is never removed from the deferred open queue. smbd will then become stuck is a loop trying to service the open request.

This bug may allow an authenticated user to exhaust resources such as memory and CPU on the server by opening multiple CIFS sessions, each of which will normally spawn a new smbd process, and sending each connection into an infinite loop.


Discovery 2007-02-05
Entry 2007-03-16
samba
ja-samba
ge 3.0.6,1 lt 3.0.24,1

CVE-2007-0452
http://www.samba.org/samba/security/CVE-2007-0452.html
a63b15f9-97ff-11dc-9e48-0016179b2dd5samba -- multiple vulnerabilities

The Samba Team reports:

Secunia Research reported a vulnerability that allows for the execution of arbitrary code in nmbd. This defect may only be exploited when the "wins support" parameter has been enabled in smb.conf.

Samba developers have discovered what is believed to be a non-exploitable buffer over in nmbd during the processing of GETDC logon server requests. This code is only used when the Samba server is configured as a Primary or Backup Domain Controller.


Discovery 2007-11-15
Entry 2007-11-21
Modified 2008-09-26
samba
samba3
ja-samba
lt 3.0.26a

gt *,1 lt 3.0.26a_2,1

26454
CVE-2007-4572
CVE-2007-5398
http://secunia.com/advisories/27450/
http://us1.samba.org/samba/security/CVE-2007-4572.html
http://us1.samba.org/samba/security/CVE-2007-5398.html
b168ddea-105a-11db-ac96-000c6ec775d9samba -- memory exhaustion DoS in smbd

The Samba Team reports:

The smbd daemon maintains internal data structures used track active connections to file and printer shares. In certain circumstances an attacker may be able to continually increase the memory usage of an smbd process by issuing a large number of share connection requests. This defect affects all Samba configurations.


Discovery 2006-07-10
Entry 2006-07-10
samba
ja-samba
ge 3.0.1,1 lt 3.0.23,1

CVE-2006-3403
http://www.samba.org/samba/security/CAN-2006-3403.html
ffcbd42d-a8c5-11dc-bec2-02e0185f8d72samba -- buffer overflow vulnerability

Secuna Research reports:

Secunia Research has discovered a vulnerability in Samba, which can be exploited by malicious people to compromise a vulnerable system. The vulnerability is caused due to a boundary error within the "send_mailslot()" function. This can be exploited to cause a stack-based buffer overflow with zero bytes via a specially crafted "SAMLOGON" domain logon packet containing a username string placed at an odd offset followed by an overly long GETDC string. Successful exploitation allows execution of arbitrary code, but requires that the "domain logons" option is enabled.


Discovery 2007-12-10
Entry 2007-12-12
Modified 2008-09-26
samba
samba3
ja-samba
lt 3.0.28

gt *,1 lt 3.0.28,1

CVE-2007-6015
http://secunia.com/advisories/27760/