Re: Samba symlink 0day flaw

[Nico Golde <oss-security+ml () ngolde de>]

Hey,
* Simo Sorce <ssorce () redhat com> [2010-02-05 22:48]:
> On Fri, 5 Feb 2010 22:05:30 +0100
> Nico Golde <oss-security+ml () ngolde de> wrote:
> > Hey,
> > * Josh Bressers <bressers () redhat com> [2010-02-05 20:11]:
> > > As many of you have probably seen, there was a supposed Samba 0day
> > > flaw posted to full-disclosure and youtube.
> > >
> > > Samba has a response to this:
> > > http://marc.info/?l=samba-technical&m=126539387432412&w=2
> > >
> > > I'm not sure if this should get a CVE id. It is documented behavior.
> > > Somewhat unexpected though. I think changing the default is the
> > > right way to go, but it may be more of a hardening measure than a
> > > security fix.
> > >
> > > Thoughts Steve?
> >
> > Given the count of users that are probably affected by this and it
> > not being documented in e.g. man 5 smb.conf I'd vote for yes! :)
> Sorry not clear what would not be documented in smb.conf ?

The wide_links variable, at least not in my copy.

Cheers
Nico
-- 
Nico Golde - http://www.ngolde.de - nion () jabber ccc de - GPG: 0xA0A0AAAA
For security reasons, all text in this mail is double-rot13 encrypted.

Attachment: _bin
Description: