|
Bugzilla – Full Text Bug Listing |
| Summary: | VUL-0: CVE-2004-0808: Denial of Service Vulnerabilities in Samba 3.0.x | ||
|---|---|---|---|
| Product: | [Novell Products] SUSE Security Incidents | Reporter: | Lars Müller <lmuelle> |
| Component: | Incidents | Assignee: | Lars Müller <lmuelle> |
| Status: | RESOLVED FIXED | QA Contact: | Security Team bot <security-team> |
| Severity: | Blocker | ||
| Priority: | P3 - Medium | CC: | aj, patch-request, security-team |
| Version: | unspecified | ||
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | CVE-2004-0808: CVSS v2 Base Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P) | ||
| Found By: | --- | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
| Bug Depends on: | |||
| Bug Blocks: | 58773 | ||
| Attachments: |
patch for the asn1 issue
patch for nmbd |
||
|
Description
Lars Müller
2004-09-09 18:22:48 UTC
This bug blocks the current Samba fixes. I'll have patches till the end of the week and prepare patches and new patchinfo files. As this bug will go public on Monday, 2004-09-13, 6am (GMT-6) we should create a timetable how to process on this bug. These bugs only hit Samba3? So i would reject only the patches for: 9.1 and SLES9, but we will release all updates together?? Andreas: This is also important for 9.2 as we have to update Samba to version 3.0.7 as announced already some days before. As soon as this bug is fixed for SLES I'll move it to SL 9.2. At comment #2: This is only Samba 3. Therefore we could still work on the Samba 2 updates as already available for SLES 8. Ok, do an update for 9.2. My bug and I'm working on the pathces ... More details: Patches for SLES 9/ 9.1 will be integrated soon. 3.0.7 will be in STABLE Monday, 2004-09-13. CAN-2004-0807 for the smbd DoS CAN-2004-0808 for the nmbd DoS Package update done for SLES 9/ 9.1. Patchinfo files for both products written and submitted. Still have to update stable to 3.0.7. Great! :) Unfortunally there came a new issue on vendor-sec last weekend: Date: Fri, 10 Sep 2004 12:31:08 -0500 From: "Gerald (Jerry) Carter" <jerry@samba.org> To: vendor-sec@lst.de Cc: security@samba.org, vendor-disclosure@idefense.com Subject: [vendor-sec] Update on Samba 3.0.x DoS issues (CAN-2004-0807 & CAN-2004-0808) Parts/Attachments: 1 Shown 36 lines Text 2 Shown 258 lines Text 3 Shown 8 lines Text 4 Shown 24 lines Text 5 Shown 8 lines Text ---------------------------------------- -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Folks, Sorry for the confusion. I had two confirmations yesterday that the smbd patch for CAN-2004-0807 was incorrect. However, both cases were actually problems with the test cases and not the fix. So as it stands right now, the original patches for nmbd and smbd are *correct*. I'm reattaching them here to avoid confusion. We will still do the public release of Samba 3.0.7 and the security announcement on Monday, Sept 13, but I need to push the time from 6am to 7am (GMT-6). Thanks for everyone's help and again, my apologies for the confusion yesterday. Created attachment 23351 [details]
patch for the asn1 issue
...
Created attachment 23352 [details]
patch for nmbd
...
That are the patches we already have in the SLES 9/ 9.1 tree. I've checke it. No changes as Jerry wrote. Just some extra confusion. Ah, ok. So we dont need to trigger any action again. Excellent. Thanks. poackages have been approved. And 3.0.7 is on the way to stable. CVE-2004-0808: CVSS v2 Base Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P) |