[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 5 Feb 2010 22:05:30 +0100
From: Nico Golde <oss-security+ml@...lde.de>
To: oss-security@...ts.openwall.com
Cc: coley <coley@...re.org>, Simo Sorce <ssorce@...hat.com>
Subject: Re: Samba symlink 0day flaw
Hey,
* Josh Bressers <bressers@...hat.com> [2010-02-05 20:11]:
> As many of you have probably seen, there was a supposed Samba 0day flaw
> posted to full-disclosure and youtube.
>
> Samba has a response to this:
> http://marc.info/?l=samba-technical&m=126539387432412&w=2
>
> I'm not sure if this should get a CVE id. It is documented behavior.
> Somewhat unexpected though. I think changing the default is the right way
> to go, but it may be more of a hardening measure than a security fix.
>
> Thoughts Steve?
Given the count of users that are probably affected by this and it not being
documented in e.g. man 5 smb.conf I'd vote for yes! :)
Cheers
Nico
--
Nico Golde - http://www.ngolde.de - nion@...ber.ccc.de - GPG: 0xA0A0AAAA
For security reasons, all text in this mail is double-rot13 encrypted.
[ CONTENT OF TYPE application/pgp-signature SKIPPED ]
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Powered by Openwall GNU/*/Linux -
Powered by OpenVZ
