Vulnerability Note VU#226184

Samba is an open-source implementation of SMB/CIFS file and print services. It is frequently included in UNIX and Linux distributions and is typically used provide file and print services to Windows clients.

The Samba daemon, smbd, contains a vulnerability in code that processes file security descriptors. While allocating heap memory to store security descriptors, a 32-bit integer counter may overflow (wrap). This counter is truncated and used by smbd to allocate memory to store security descriptors. Without checking the size of this value, smbd may allocate insufficient memory, resulting in a buffer overflow. Heap memory control structures can be overwritten, corrupting heap memory, and possibly allowing the execution of arbitrary code. More information is available in iDEFENSE Security Advisory 12.16.04.

An authenticated, remote attacker could exploit this vulnerability using a specially crafted SMB packet. Note that an attacker may be authenticated to an anonymous share, in which case the attacker would not require valid credentials, just a TCP connection.

An authenticated, remote attacker could execute arbitrary code or cause a denial of service on a vulnerable system. The smbd daemon typically runs with root privileges.

Patch or upgrade
Apply a patch or upgrade as specified by your vendor. This vulnerability is addressed in Samba 3.0.10 and a patch (with signature) is available for Samba 3.0.9.

Restrict access

The Samba Server Security web page documents several ways to restrict access to Samba servers based on network interface, IP network, and TCP ports (139 and 445). Also, consider disabling or carefully restricting access to anonymous shares.