-----BEGIN PGP SIGNED MESSAGE-----

______________________________________________________________________________

                        SUSE Security Announcement

        Package:                samba
        Announcement-ID:        SUSE-SA:2004:040
        Date:                   Monday, Nov 15th 2004 18:00 MEST
        Affected products:      9.1, 9.2
                                SUSE Linux Enterprise Server 9
                                Novell Linux Desktop 9
        Vulnerability Type:     potential remote buffer overflow
                                remote denial of service
        Severity (1-10):        7
        SUSE default package:   yes
        Cross References:       CAN-2004-0930
                                CAN-2004-0882

    Content of this advisory:
        1) security vulnerabilities resolved:
             - remote buffer overflow and remote denial of service conditions
               in Samba 3 packages.
           problem description
        2) solution/workaround
        3) special instructions and notes
        4) package location and checksums
        5) pending vulnerabilities, solutions, workarounds:
            - bogofilter
            - libxml2
            - clamav
            - various PDF viewers            - mozilla /tmp issues
            - sharutils
            - phpMyAdmin
            - gaim
            - sysconfig
            - perl-MIME-Tools, perl-Archive-ZIP
            - apache / mod_include
            - apache2 / mod_SSL

        6) standard appendix (further information)

______________________________________________________________________________

1) problem description, brief discussion

    There is a problem in the Samba file sharing service daemon, which
    allows a remote user to have the service consume lots of computing
    power and potentially crash the service by querying special wildcarded
    filenames.

    This attack can be successful if the Samba daemon is running and a
    remote user has access to a share (even read only).

    The Samba team has issued the new Samba version 3.0.8 to fix this
    problem, this update backports the relevant patch.

    This issue has been assigned the Mitre CVE ID CAN-2004-0930.


    Stefan Esser found a problem in the Unicode string handling in the
    Samba file handling which could lead to a remote heap buffer
    overflow and might allow remote attackers to inject code in the smbd
    process.

    This issue has been assigned the Mitre CVE ID CAN-2004-0882.


    We provide updated packages for both these problems.

    The Samba version 2 packages are not affected by this problem.

2) solution/workaround

    Update to the released packages.

    The only workaround would be not to use Samba.

3) special instructions and notes

    Restart the Samba daemon by entering the following command as root:

       rcsmb try-restart

4) package location and checksums

    Download the update package for your distribution and verify its
    integrity by the methods listed in section 3) of this announcement.
    Then, install the package using the command "rpm -Fhv file.rpm" to apply
    the update.
    Our maintenance customers are being notified individually. The packages
    are being offered for installation from the maintenance web.


    x86 Platform:

    SUSE Linux 9.2:
          ea47b14d991eadfc8319d248441eb6cc
    patch rpm(s):
          097048624c2ca75d66113c994e278bf8
    source rpm(s):
          e90db6a68fca1660ecb1f3e833034b14

    SUSE Linux 9.1:
          2701bcc3f8a702828a84ca6ee6f58c47
    patch rpm(s):
          2ec25548844d0741ece92ea34726b962
    source rpm(s):
          ce60179f36ea0005df7c69b64849b387


    x86-64 Platform:

    SUSE Linux 9.2:
          13b65db6a9cd46df94cd5171d4c3b916
    patch rpm(s):
          0e7dd46cc7187ae3a7419dfdb8cdd1b8
    source rpm(s):
          e90db6a68fca1660ecb1f3e833034b14

    SUSE Linux 9.1:
          8b442529ac042ecea469972c2c85e4b5
    patch rpm(s):
          f3c95f1940f05652393a178b6a12e226
    source rpm(s):
          053403aa610ea0df5b6337934e753acc

______________________________________________________________________________

5)  Pending vulnerabilities in SUSE Distributions and Workarounds:

    A lot of less important issues have been addressed since the last
    security update. To avoid spamming they are summarized here.

     - bogofilter

       The bogofilter team has notified us about a denial of service condition
       in bogofilter on SUSE Linux 9.2, where a non-conformant encoded word
       could lead to a denial of service attack against bogofilter. This issue
       has been assigned Mitre CVE ID CAN-2004-1007. Fixed packages are
       available.

     - libxml2

       Several buffer overflows in URL handling in libxml2 were found by
       "infamous41md". This issue has been assigned the Mitre CVE ID
       CAN-2004-0989. Fixed packages are available.

     - clamav

       The clamav version shipped with SUSE Linux is too old for the new
       data files. The version has been upgraded to 0.80.

     - various xpdf based PDF viewers
       The SUSE QA team found several 64-bit issues in the xpdf fixes
       we released for CAN-2004-0888 and CAN-2004-0889. These have been
       fixed and updated packages have been released.

     - Mozilla /tmp issues

       The creation of several /tmp files in Mozilla and Mozilla based
       programs left private files with world readable permissions so that
       local users could read documents of other users. Packages fixing
       this problem have been released.

     - sharutils

       Buffer overflows and shell quoting problems have been found in the
       "shar" program which creates self-extracting shell archives.
       Fixed packages are available.

    - phpMyAdmin

       Missing parameter escapes allowed users of the phpMyAdmin frontend
       to execute commands as the www user on the target host. Fixed packages
       are available.

    - gaim

       More problems in newer versions of GAIM have been found and are tracked
       with the Mitre CVE ID CAN-2004-0891. Fixed packages are available.

    - sysconfig

       A permission error left the passphrase of WPA authorized wireless
       key world readable in SUSE Linux 9.2. Fixed packages are available.

    - perl-Mime-Tools / perl-Archive-ZIP

       Problems in the perl-MIME-Tools and perl-Archive-ZIP packages have
       been found which could allow virii to pass virus scanners using those
       packages (like for instance clamav). Fixed packages are in testing
       and will be released soon.

    - Apache 1.3 / mod_include

       A potential buffer overflow and a argument sanitization problem
       were found in the mod_include Apache 1.3 module. These issues
       are tracked as CAN-2004-0940 and CAN-2004-0492 by Mitre CVE.
       Fixed packages are in testing and will be released soon.

    - Apache 2 / mod_SSL

       SSL Ciphersuite bypass problems were identified and fixed by the
       Apache team in Apache 2. This is tracked under the Mitre CVE ID
       CAN-2004-0885. Fixed packages are in testing and will be released
       soon.

______________________________________________________________________________

6)  standard appendix: authenticity verification, additional information

  - Package authenticity verification:

    SUSE update packages are available on many mirror ftp servers all over
    the world. While this service is being considered valuable and important
    to the free and open source software community, many users wish to be
    sure about the origin of the package and its content before installing
    the package. There are two verification methods that can be used
    independently from each other to prove the authenticity of a downloaded
    file or rpm package:
    1) md5sums as provided in the (cryptographically signed) announcement.
    2) using the internal gpg signatures of the rpm package.

    1) execute the command
        md5sum 
       after you downloaded the file from a SUSE ftp server or its mirrors.
       Then, compare the resulting md5sum with the one that is listed in the
       announcement. Since the announcement containing the checksums is
       cryptographically signed (usually using the key security@suse.de),
       the checksums show proof of the authenticity of the package.
       We recommend against subscribing to security lists that cause the
       e-mail message containing the announcement to be modified
       so that the signature does not match after transport through the mailing
       list software.
       Downsides: You must be able to verify the authenticity of the
       announcement in the first place. If RPM packages are being rebuilt
       and a new version of a package is published on the ftp server, all
       md5 sums for the files are useless.

    2) rpm package signatures provide an easy way to verify the authenticity
       of an rpm package. Use the command
        rpm -v --checksig 
       to verify the signature of the package, where  is the
       file name of the rpm package that you have downloaded. Of course,
       package authenticity verification can only target an uninstalled rpm
       package file.
       Prerequisites:
        a) gpg is installed
        b) The package is signed using a certain key. The public part of this
           key must be installed by the gpg program in the directory
           ~/.gnupg/ under the user's home directory who performs the
           signature verification (usually root). You can import the key
           that is used by SUSE in rpm packages for SUSE Linux by saving
           this announcement to a file ("announcement.txt") and
           running the command (do "su -" to be root):
            gpg --batch; gpg < announcement.txt | gpg --import
           SUSE Linux distributions version 7.1 and thereafter install the
           key "build@suse.de" upon installation or upgrade, provided that
           the package gpg is installed. The file containing the public key
           is placed at the top-level directory of the first CD (pubring.gpg)
           and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de .


  - SUSE runs two security mailing lists to which any interested party may
    subscribe:

    suse-security@suse.com
        -   general/linux/SUSE security discussion.
            All SUSE security announcements are sent to this list.
            To subscribe, send an email to
                .

    suse-security-announce@suse.com
        -   SUSE's announce-only mailing list.
            Only SUSE's security announcements are sent to this list.
            To subscribe, send an email to
                .

    For general information or the frequently asked questions (faq)
    send mail to:
         or
         respectively.

    ====================================================================    SUSE's security contact is  or .
    The  public key is listed below.
    ====================================================================