Subject: [yellowdog-updates] Yellow Dog Linux Security Advisory: YDU-20010725-8
dburcaw@newhope.terraplex.com
Date: Thu Aug 09 2001 - 16:05:06 MDT
Yellow Dog Linux Security Announcement
--------------------------------------
Package: samba
Issue Date: July 25, 2001
Priority: high
Advisory ID: YDU-20010725-8
1. Topic:
New Samba packages are available that fix a
security problem with remote clients giving special
NetBIOS names to the server.
2. Problem:
"The Samba configuration used in [Yellow Dog] Linux logs operations into
[remotenetbiosname].log. By sending an invalid netbiosname, Samba could be
fooled to write its log in unintended and inappropriate locations. This can
be especially dangerous if combined with a symlink created by a local user."
(from Red Hat's security advisory)
3. Solution:
a) Updating via yup...
We suggest that you use the Yellow Dog Update Program (yup)
to keep your system up-to-date. The following command(s) will
automatically retrieve and install the fixed version of
this update onto your system:
yup update samba
yup update samba-client
yup update samba-common
b) Updating manually...
The update can also be retrieved manually from our ftp site
below along with the rpm command that should be used to install
the update. (Please use a mirror site)
ftp://ftp.yellowdoglinux.com/pub/yellowdog/updates/yellowdog-2.0/ppc/RPMS/
rpm -Fvh samba-2.0.10-0.7.ppc.rpm
rpm -Fvh samba-client-2.0.10-0.7.ppc.rpm
rpm -Fvh samba-common-2.0.10-0.7.ppc.rpm
4. Verification
MD5 checksum Package
-------------------------------- ----------------------------
6ce8593338dfd8c37a7fa7edb7e36005 SRPMS/samba-2.0.10-0.7.src.rpm
18f3508d6a21053f455bdb85d723b9cb ppc/RPMS/samba-2.0.10-0.7.ppc.rpm
e90fa3a6502e62f09c752810ed5f0151 ppc/RPMS/samba-client-2.0.10-0.7.ppc.rpm
05cf7243dd7f58001b08f521aebace5d ppc/RPMS/samba-common-2.0.10-0.7.ppc.rpm
If you wish to verify that each package has not been corrupted or tampered with,
examine the md5sum with the following command: rpm --checksig --nogpg filename
5. Misc.
Terra Soft has setup a moderated mailing list where these security, bugfix, and package
enhancement announcements will be posted. See http://lists.yellowdoglinux.com/ for more
information.
For information regarding the usage of yup, the Yellow Dog Update Program, see
http://devel.yellowdoglinux.com/rp_yup.shtml
This archive was generated by hypermail 2a24 : Thu Aug 09 2001 - 16:05:41 MDT