CVE Request (samba)

[Jan Lieskovsky <jlieskov () redhat com>]

Hello Steve,

  Sascha Herrmann has noticed a file access permissions 
change, present by one of the critical TBD files,
shipped within the Samba product (group_mapping.{tdb,ldb},
mask changed from 0600 to 0666). As this file is of 
critical importance for proper function of the Samba tool,
it should not allow read and write access for the group
and for others. 

Affected Samba versions: 3.2.0-* +
========================

Current behavior: (samba-3.2.0-2.17)
====================================

# ls -l group_mapping.ldb
-rw-rw-rw- 1 root root 77824 2008-08-25 10:56 group_mapping.ldb

Expected behavior (present in all prior Samba versions): 
========================================================

# ls -l /var/lib/samba/group_mapping.tdb
-rw------- 1 root root 4096 2008-08-25 11:21 /var/lib/samba/group_mapping.tdb

Public mention of this report: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496073
=============================

For the reference and explanation of meaning of Samba *.TBD files, please see:
==============================================================================

http://wiki.samba.org/index.php/Frequently_Asked_Questions
http://www.samba.org/samba/docs/man/Samba-HOWTO-Collection/msdfs.html

Could you please allocate a CVE id for this issue?

Thank you in advance.

Kind regards
Jan iankko Lieskovsky
RH Security Response Team