{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "CIFS/9000 Server 2.2 versions A.01.08, A.01.08.01 et A.01.09.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Samba",
          "scada": false
        }
      }
    },
    {
      "description": "Samba versions 2.2.2 \u00e0 2.2.6 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Samba",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nSamba est une impl\u00e9mentation du protocole SMB.\n\nUne vuln\u00e9rabilit\u00e9 de type d\u00e9bordement de m\u00e9moire est pr\u00e9sente dans la\nroutine calculant la longueur utilis\u00e9e lors de la demande de changement\nd\u0027un mot de passe r\u00e9alis\u00e9e par un client.\n\nL\u0027exploitation de cette vuln\u00e9rabilit\u00e9 peut permettre \u00e0 un utilisateur\nmal intentionn\u00e9 d\u0027ex\u00e9cuter, \u00e0 distance, du code arbitraire avec les\nprivil\u00e8ges de l\u0027administrateur syst\u00e8me root.\n\n## Solution\n\nLa version 2.2.7 de Samba corrige cette vuln\u00e9rabilit\u00e9.\n",
  "cves": [],
  "initial_release_date": "2002-11-25T00:00:00",
  "last_revision_date": "2002-12-13T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 DSA-200 de Debian :",
      "url": "http://www.debian.org/security/2002/dsa-200"
    },
    {
      "title": "Site de Samba :",
      "url": "http://www.samba.org"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 20021204-01-I de SGI :",
      "url": "ftp://patches.sgi.com/support/free/security/advisories/20021204-01-I"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 SuSE-SA:2002:045 de SuSE :",
      "url": "http://www.suse.com/de/security/2002_045_samba.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 RHSA-2002:266 de Red Hat :",
      "url": "http://rhn.redhat.com/errata/RHSA-2002-266.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 HPSBUX0212-0230 de Hewlett-Packard :",
      "url": "http://itrc.hp.com"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 MDKSA-2002:081 de Mandrake :",
      "url": "http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2002:081"
    }
  ],
  "reference": "CERTA-2002-AVI-252",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2002-11-25T00:00:00.000000"
    },
    {
      "description": "ajout de la r\u00e9f\u00e9rence au bulletin de s\u00e9curit\u00e9 MDKSA-2002:081 de Mandrake.",
      "revision_date": "2002-11-27T00:00:00.000000"
    },
    {
      "description": "ajout de la r\u00e9f\u00e9rence au bulletin de s\u00e9curit\u00e9 20021204-01-I de SGI.",
      "revision_date": "2002-12-10T00:00:00.000000"
    },
    {
      "description": "ajout de la r\u00e9f\u00e9rence au bulletin de s\u00e9curit\u00e9 HPSBUX0212-0230 de Hewlett-Packard.",
      "revision_date": "2002-12-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 de type d\u00e9bordement de m\u00e9moire pr\u00e9sente dans le\nserveur smbd permet \u00e0 un utilisateur mal intentionn\u00e9 de r\u00e9aliser, sous\ncertaines conditions, une \u00e9l\u00e9vation de privil\u00e8ges.\n",
  "title": "Vuln\u00e9rabilit\u00e9 de Samba",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Avis de S\u00e9curit\u00e9 DSA-200 de Debian",
      "url": null
    },
    {
      "published_at": null,
      "title": "Avis de S\u00e9curit\u00e9 RHSA-2002:266 de Red Hat",
      "url": null
    },
    {
      "published_at": null,
      "title": "Avis de S\u00e9curit\u00e9 SuSE-SA:2002:045 de SuSE",
      "url": null
    }
  ]
}