Mandrake Linux Security Advisory : samba (MDKSA-2007:034)
High Nessus Plugin ID 24647
SynopsisThe remote Mandrake Linux host is missing one or more security updates.
DescriptionA logic error in the deferred open code for smbd may allow an authenticated user to exhaust resources such as memory and CPU on the server by opening multiple CIFS sessions, each of which will normally spawn a new smbd process, and sending each connection into an infinite loop. (CVE-2007-0452)
The name of a file on the server's share is used as the format string when setting an NT security descriptor through the afsacl.so VFS plugin. (CVE-2007-0454)
Updated packages have been patched to address these issues.
SolutionUpdate the affected packages.