FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The last vuln.xml file processed by FreshPorts is:

nothing found there

List all Vulnerabilities, by package

List all Vulnerabilities, by date

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
ffcbd42d-a8c5-11dc-bec2-02e0185f8d72samba -- buffer overflow vulnerability

Secuna Research reports:

Secunia Research has discovered a vulnerability in Samba, which can be exploited by malicious people to compromise a vulnerable system. The vulnerability is caused due to a boundary error within the "send_mailslot()" function. This can be exploited to cause a stack-based buffer overflow with zero bytes via a specially crafted "SAMLOGON" domain logon packet containing a username string placed at an odd offset followed by an overly long GETDC string. Successful exploitation allows execution of arbitrary code, but requires that the "domain logons" option is enabled.


Discovery 2007-12-10
Entry 2007-12-12
Modified 2008-09-26
samba
samba3
ja-samba
lt 3.0.28

gt *,1 lt 3.0.28,1

CVE-2007-6015
http://secunia.com/advisories/27760/
2bc96f18-683f-11dc-82b6-02e0185f8d72samba -- nss_info plugin privilege escalation vulnerability

The Samba development team reports:

The idmap_ad.so library provides an nss_info extension to Winbind for retrieving a user's home directory path, login shell and primary group id from an Active Directory domain controller. This functionality is enabled by defining the "winbind nss info" smb.conf option to either "sfu" or "rfc2307".

Both the Windows "Identity Management for Unix" and "Services for Unix" MMC plug-ins allow a user to be assigned a primary group for Unix clients that differs from the user's Windows primary group. When the rfc2307 or sfu nss_info plugin has been enabled, in the absence of either the RFC2307 or SFU primary group attribute, Winbind will assign a primary group ID of 0 to the domain user queried using the getpwnam() C library call.


Discovery 2007-09-11
Entry 2007-09-21
Modified 2008-09-26
samba
lt 3.0.26a

gt *,1 lt 3.0.26a,1

CVE-2007-4138
http://www.samba.org/samba/security/CVE-2007-4138.html
3546a833-03ea-11dc-a51d-0019b95d4f14samba -- multiple vulnerabilities

The Samba Team reports:

A bug in the local SID/Name translation routines may potentially result in a user being able to issue SMB/CIFS protocol operations as root.

When translating SIDs to/from names using Samba local list of user and group accounts, a logic error in the smbd daemon's internal security stack may result in a transition to the root user id rather than the non-root user. The user is then able to temporarily issue SMB/CIFS protocol operations as the root user. This window of opportunity may allow the attacker to establish additional means of gaining root access to the server.

Various bugs in Samba's NDR parsing can allow a user to send specially crafted MS-RPC requests that will overwrite the heap space with user defined data.

Unescaped user input parameters are passed as arguments to /bin/sh allowing for remote command execution.

This bug was originally reported against the anonymous calls to the SamrChangePassword() MS-RPC function in combination with the "username map script" smb.conf option (which is not enabled by default).

After further investigation by Samba developers, it was determined that the problem was much broader and impacts remote printer and file share management as well. The root cause is passing unfiltered user input provided via MS-RPC calls to /bin/sh when invoking externals scripts defined in smb.conf. However, unlike the "username map script" vulnerability, the remote file and printer management scripts require an authenticated user session.


Discovery 2007-05-14
Entry 2007-05-16
Modified 2008-09-26
samba
ja-samba
gt 3.* lt 3.0.25

gt 3.*,1 lt 3.0.25,1

CVE-2007-2444
CVE-2007-2446
CVE-2007-2447
http://de5.samba.org/samba/security/CVE-2007-2444.html
http://de5.samba.org/samba/security/CVE-2007-2446.html
http://de5.samba.org/samba/security/CVE-2007-2447.html
a63b15f9-97ff-11dc-9e48-0016179b2dd5samba -- multiple vulnerabilities

The Samba Team reports:

Secunia Research reported a vulnerability that allows for the execution of arbitrary code in nmbd. This defect may only be exploited when the "wins support" parameter has been enabled in smb.conf.

Samba developers have discovered what is believed to be a non-exploitable buffer over in nmbd during the processing of GETDC logon server requests. This code is only used when the Samba server is configured as a Primary or Backup Domain Controller.


Discovery 2007-11-15
Entry 2007-11-21
Modified 2008-09-26
samba
samba3
ja-samba
lt 3.0.26a

gt *,1 lt 3.0.26a_2,1

26454
CVE-2007-4572
CVE-2007-5398
http://secunia.com/advisories/27450/
http://us1.samba.org/samba/security/CVE-2007-4572.html
http://us1.samba.org/samba/security/CVE-2007-5398.html