--CblX+4bnyfN0pR09
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 200703-09
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/ 
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: High
     Title: Smb4K: Multiple vulnerabilities
      Date: March 09, 2007
      Bugs: #156152
        ID: 200703-09

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======
Multiple vulnerabilities have been identified in Smb4K.

Background
=========
Smb4K is a SMB/CIFS (Windows) share browser for KDE.

Affected packages
================
    -------------------------------------------------------------------
     Package         /  Vulnerable  /                       Unaffected
    -------------------------------------------------------------------
  1  net-misc/smb4k      < 0.6.10a                          >= 0.6.10a

Description
==========
Kees Cook of the Ubuntu Security Team has identified multiple
vulnerabilities in Smb4K.

* The writeFile() function of smb4k/core/smb4kfileio.cpp makes
  insecure usage of temporary files.

* The writeFile() function also stores the contents of the sudoers
  file with incorrect permissions, allowing for the file's contents to
  be world-readable.

* The createLockFile() and removeLockFile() functions improperly
  handle lock files, possibly allowing for a race condition in file
  handling.

* The smb4k_kill utility distributed with Smb4K allows any user in
  the sudoers group to kill any process on the system.

* Lastly, there is the potential for multiple stack overflows when
  any Smb4K utility is used with the sudo command.

Impact
=====
A local attacker could gain unauthorized access to arbitrary files via
numerous attack vectors. In some cases to obtain this unauthorized
access, an attacker would have to be a member of the sudoers list.

Workaround
=========
There is no known workaround at this time.

Resolution
=========
All Smb4K users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=net-misc/smb4k-0.6.10a"

References
=========
  [ 1 ] CVE-2007-0472
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0472 
  [ 2 ] CVE-2007-0473
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0473 
  [ 3 ] CVE-2007-0474
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0474 
  [ 4 ] CVE-2007-0475
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0475 

Availability
===========
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200703-09.xml 

Concerns?
========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at 
http://bugs.gentoo.org. 

License
======
Copyright 2007 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5 

--CblX+4bnyfN0pR09
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iQEVAwUBRfHlcTvRww8BFPxFAQIM5Af+Imku1bB+wcNPzpiWOnGQ1zZ3ztpmpJdl
babUS5sTVWA9C/5H1IPFkuJN3Ha2AsZI1Qzipvr5BhblwHoQMIzrBQki/cxGjLgk
/EReiQUx4tQCteLD4RiQ+htkf+OD1xDOvkjXSjTK3Y55l9qjXkDxER6n5nnQ7tvp
gRYng+Ln9z9hpOCjudSxrknRb+iiKohsTfenIcRB0NgEr9TeYmQ78MdkP7XrrpeY
rjh6unkYUpAwtdJ8tuMkrjtxcNLyiyUo64JO5BQ2+NoNx/8KsQjs4BqdNDrHOELB
CA9o8tAvgYfj2WRVWgglfXMTFi8pvzdkXibw9DL9x/ZPIi22V6MhGQ==Omrz
-----END PGP SIGNATURE-----

--CblX+4bnyfN0pR09--