Two vulnerabilities have been reported in Samba, which can be exploited by malicious users to bypass certain security restrictions and by malicious people to potentially compromise a user's system.

1) An uninitialised memory access error exists in smbd when denying attempts to modify a restricted access control list (ACL). This can be exploited to potentially modify the ACL of an already writable file without required permissions.

Successful exploitation requires that "dos filemode" is set to "yes" in smb.conf.

The vulnerability is reported in versions 3.0.31 through 3.3.5.

2) A format string error exists in the "smbclient" utility when processing file names received as command arguments. This can be exploited to potentially execute arbitrary code by tricking a user into e.g. issuing a "put" command having a malicious file name argument in "smbclient".

The vulnerability is reported in versions 3.2.0 through 3.2.12.

Solution
Update to version 3.0.35, 3.2.13, or 3.3.6.
Further details available to Secunia VIM customers

Provided and/or discovered by
1) Jeremy Allison
2) The vendor credits Reinhard Nissl.

Original Advisory
http://us1.samba.org/samba/security/CVE-2009-1886.html
http://us1.samba.org/samba/security/CVE-2009-1888.html

Deep Links
Links available to Secunia VIM customers