[Pkg-samba-maint] Bug#567554: Privilege escalation in mount.cifs

[Moritz Muehlenhoff]

Package: smbfs
Severity: grave
Tags: security

This is CVE-2009-3297:
https://bugzilla.samba.org/show_bug.cgi?id=6853

/usr/share/doc/smbfs/TODO.Debian states:
  There is concern about the setuid status of binaries in this package.
  The audit status of the concerned binaries is unclear.  We should
  figure out whether it is reasonable to provide the flexible user mount
  capabilities or whether a more restricted setup is better, at least by
  default.

Given that Jeremy Allison writes in the bug above you should probably
drop the setuid for Squeeze:

   ------- Comment [88]#2 From [89]Jeremy Allison 2009-10-28 12:51:31 CST -------

 I object strongly to dealing with this as a Samba security issue. This code has
 not bee audited AND MUST NOT BE SHIPPED SETUID root.

Cheers,
        Moritz

-- System Information:
Debian Release: squeeze/sid
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: i386 (i686)

Kernel: Linux 2.6.32-trunk-686 (SMP w/1 CPU core)
Locale: LANG=C, LC_CTYPE=de_DE.ISO-8859-15 at euro (charmap=ISO-8859-15)
Shell: /bin/sh linked to /bin/bash

Versions of packages smbfs depends on:
ii  libc6                2.10.2-2            GNU C Library: Shared libraries
ii  libcomerr2           1.41.9-1            common error description library
ii  libkeyutils1         1.2-12              Linux Key Management Utilities (li
ii  libkrb53             1.6.dfsg.4~beta1-13 Transitional library package/krb4 
ii  libldap-2.4-2        2.4.17-2.1          OpenLDAP libraries
ii  libpopt0             1.15-1              lib for parsing cmdline parameters
pn  libtalloc1           <none>              (no description available)
ii  libwbclient0         2:3.4.3-2           Samba winbind client library
ii  netbase              4.40                Basic TCP/IP networking system
pn  samba-common         <none>              (no description available)

smbfs recommends no packages.

Versions of packages smbfs suggests:
pn  smbclient                     <none>     (no description available)