Michal Medvecky has reported a security issue in samba, which can be exploited by malicious, local users to escalate their privileges.

The problem is that Samba 3.0 combined with Linux Kernel 2.6 fails to strip setuid bits from network shares. This can be exploited to gain escalated privileges if "smbmnt" is setuid root by mounting a network share with malicious setuid root binaries.

By default "smbmnt" isn't setuid.

However, it has been reported that Debian and Mandrake ships with "smbmnt" setuid root.

NOTE: Another problem which has been reported by the vendor, is that accounts created by "mksmbpasswd.sh" have uninitialised passwords. This can be exploited by malicious people to log into these accounts.

Solution
Remove the setuid bit from "smbmnt".
Further details available in Customer Area

Provided and/or discovered by
Michal Medvecky

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area