[rock-user] [Security Announcement] samba (RLSA-20060331-01)

This is a ROCK Linux Security Announcement.

Package: samba
Announcement ID: RLSA-20060331-01
Date: 2006-03-31
Affected Distributions: Crystal, LiveCD
Affected Releases: Crystal ROCK CLT
Cross References:  CAN_2006-1059
Fixed at trunk revision: 7376

Content of this advisory:
1) Problem Description
2) Solution or Work-Around
3) Special instructions and notes
4) Updateing your source tree
5) Source package update
6) Binary package update

--------------------------------------------------------------------------------

1) Problem Description

The machine trust account password is the secret shared
between a domain controller and a specific member server.
Access to the member server machine credentials allows
an attacker to impersonate the server in the domain and
gain access to additional information regarding domain
users and groups.

The winbindd daemon included in Samba 3.0.21 and subsequent
patch releases (3.0.21a-c) writes the clear text of server's
machine credentials to its log file at level 5.  The winbindd
log files are world readable by default and often log files
are requested on open mailing lists as tools used to debug
server misconfigurations.

This affects servers configured to use domain or ads security
and possibly Samba domain controllers as well (if configured
to use winbindd).

2) Solution or Workaround
Set winbind:4 or lower to prevent passwords to be logged.
Please update this package to version 3.0.22 or apply the patches
provided by samba.org.

3) Special instruction and notes
Restart the samba server after update.

4) Updateing your source tree
If you are using a subversion checkout of trunk, run:
 svn up

If you are using submaster run,
 sm sync
to merge the update from trunk into your tree

5) Source package update
As a user of an affected distribution you can update this package by
rebuilding it on your machine
run
 rocket updsrc
to update your local sources and
 rocket emerge samba
to install the updated package

6) Binary package update
there are no new binary packages available for this package yet.[