CVE-2007-4138: Samba 3.0.25–3.0.25c gives all users root group rights

On Debian systems running Samba version 3.0.25 through 3.0.25c, enabling the "winbind nss info" setting for RFC2307 or Services for UNIX causes any local user whose primary group information is missing to be placed in the system's root group (group ID 0). This effectively gives those users the same file‑access rights as the system administrator, which can expose sensitive data or allow unintended changes. Update to a newer Samba release or disable the problematic winbind setting, and make sure every user has a defined primary group attribute.

• https://security-tracker.debian.org/tracker/CVE-2007-4138 Vendor Advisory
• http://docs.info.apple.com/article.html?artnum=307179
• http://secunia.com/advisories/26764 Patch Vendor Advisory
• http://secunia.com/advisories/26776
• http://secunia.com/advisories/26795
• http://secunia.com/advisories/26834
• http://securityreason.com/securityalert/3135
• http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware...
• http://www.redhat.com/support/errata/RHSA-2007-1016.html
• http://www.redhat.com/support/errata/RHSA-2007-1017.html
• http://www.samba.org/samba/security/CVE-2007-4138.html
• http://www.securityfocus.com/archive/1/479078/100/0/threaded
• http://www.securityfocus.com/bid/25636 Patch
• http://www.securitytracker.com/id?1018681
• http://www.us-cert.gov/cas/techalerts/TA07-352A.html US Government Resource
• http://www.vupen.com/english/advisories/2007/3120
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36560
• https://issues.rpath.com/browse/RPL-1705
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3...
• https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00201....