Re: [SECURITY] Samba 2.2.8a security available for download

I see the same problem.

When quering the RPM arch, I get an odd response
(I would expect to see i386):

$ rpm -qp --qf '%{ARCH}\n' samba-2.2.8a-1.i386.rpm
i?86

On Mon, Apr 07, 2003 at 08:32:50AM -0700, Stephen J. Gowdy wrote:
> Hi All,
> 
> I just downloaded the RPM for RH6.2 and when trying to install I get;
> 
> [root@machine samba]# rpm -Uhv ~gowdy/samba-2.2.8a-1.i386.rpm --force
> Preparing...                ########################################### 
> [100%]
> package samba-2.2.8a-1 is for a different architecture
> [root@machine samba]# uname -a
> Linux machine 2.4.18 #2 Sat Apr 27 21:56:49 PDT 2002 i686 unknown
> 
> Any ideas?
> 
> 
> 
> Gerald (Jerry) Carter wrote:
> >-----BEGIN PGP SIGNED MESSAGE-----
> >Hash: SHA1
> >
> >This release provides an important security fix outlined in the
> >release notes that follow. This is the latest stable release of
> >Samba and the version that all production Samba servers should be
> >running for all current bug-fixes.
> >
> >The source code can be downloaded from :
> >
> >    http://download.samba.org/samba/ftp/
> >
> >in the file samba-2.2.8a.tar.gz or samba-2.2.8a.tar.bz2.
> >Both archives have been signed using the Samba Distribution Key
> >(available in the samba directory on the web server).
> >
> >Binary packages will be released shortly for major platforms and
> >can be found at
> >
> >    http://download.samba.org/samba/ftp/Binary_Packages/
> >
> >As always, all bugs are our responsibility.
> >
> >                           --Sincerely
> >                           The Samba Team
> >
> >
> >               ****************************************
> >               * IMPORTANT: Security bugfix for Samba *
> >               ****************************************
> >
> >
> >Summary
> >- -------
> >
> >Digital Defense, Inc. has alerted the Samba Team to a serious
> >vulnerability in all stable versions of Samba currently shipping.
> >The Common Vulnerabilities and Exposures (CVE) project has assigned
> >the ID CAN-2003-0201 to this defect.
> >
> >This vulnerability, if exploited correctly, leads to an anonymous
> >user gaining root access on a Samba serving system. All versions
> >of Samba up to and including Samba 2.2.8 are vulnerable. An active
> >exploit of the bug has been reported in the wild. Alpha versions of
> >Samba 3.0 and above are *NOT* vulnerable.
> >
> >
> >Credit
> >- ------
> >
> >The Samba Team would like to thank Erik Parker and the team at
> >Digital Defense, Inc. for their efforts spent in the responsible
> >and timely reporting of this bug.
> >
> >
> >Patch Availability
> >- ------------------
> >
> >The Samba 2.2.8a release contains only updates to address this
> >security issue. A roll-up patch for release 2.2.7a and 2.0.10
> >addressing both CAN-2003-0201 and CAN-2003-0085 can be obtained
> >from http://www.samba.org/samba/ftp/patches/security/.
> >
> >
> >
> >
> >
> >-----BEGIN PGP SIGNATURE-----
> >Version: GnuPG v1.2.0 (GNU/Linux)
> >Comment: For info see http://quantumlab.net/pine_privacy_guard/
> >
> >iD8DBQE+kWjmIR7qMdg1EfYRAgJXAKCFXWq0lMKStlsIXBZohdqJQnzmQQCgnmgx
> >S0bz5z81vQCQMkKFzENtXpU=
> >=1LJQ
> >-----END PGP SIGNATURE-----
> >
> >
> 

-- 
Karl Amrhein,  <[email protected]>  | www.slac.stanford.edu/~ksa
SLAC Computing Services, Systems Group  | 650.926.5083  Bldg 50, 364