6 replies to this topic

[hypnotoad]

http://www.heise.de/...rn-1518799.html

Vielleicht kann einer der Dev´ s kurz bescheid geben wenn das Paket im pli repository gefixt ist.

Danke

[mrk72]

Grundsätzlich sollte das keine große Gefahr sein, außer Du hast die Samba-Ports im Router freigegeben.

Ich werd mir das Paket aber mal anschauen.

[MiLo]

The samba server on the box gives away free root access to everyone. You cannot have a leak in something that's basically a big gaping hole.

[nietgiftig]

The samba server on the box gives away free root access to everyone. You cannot have a leak in something that's basically a big gaping hole.

hehe, Nice

Lot of sleepless time for some people!

[hypnotoad]

is this a joke milo? even more dangerous that the smbd is installed by default.

For me its no Problem, first thing i do after flashing is to remove the smb package

OK the most people uses the box behind a nat but i guess it would be a good idea to inform the useres of this security issue

Edited by hypnotoad, 25 April 2012 - 18:15.

[MiLo]

No joke. It has always been like that.

The default password is blank. It also runs telnet, HTTP and FTP servers that require no authentication whatsoever. Maybe I forgot some other service.

Bottom line: Don't put the box on the (inter)net without a router in between, and don't forward any port except 22 (ssh), which is the one and only secure thing the box has. Anything else (including HTTPS) should never be allowed outside your LAN, with or without passwords.

And no, we're not gonna change that.

[mrk72]

Da samba 3.6.5 neben dem Sicherheitsupdate auch noch das neue SMB2 Protokoll hat, hab ich mal ein package erstellt
Siehe hier:#20