Vulnerability Note VU#298233

Samba contains buffer overflow in SMB/CIFS packet fragment reassembly code

Overview

A buffer overflow vulnerability has been discovered in Samba. An updated version has been released.

I. Description

A remotely exploitable buffer overflow vulnerability was discoved to affect Samba versions 2.0.x through 2.2.7a. From their bulletin:

The SuSE security audit team, in particular Sebastian Krahmer, has found a flaw in the Samba main smbd code which could allow an external attacker to remotely and anonymously gain Super User (root) privileges on a server running a Samba server.

This flaw exists in previous versions of Samba from 2.0.x to 2.2.7a inclusive. This is a serious problem and all sites should either upgrade to Samba 2.2.8 immediately or prohibit access to TCP ports 139 and 445. Advice created by Andrew Tridgell, the leader of the Samba Team, on how to protect an unpatched Samba server is given at the end of this section.

The SMB/CIFS protocol implemented by Samba is vulnerable to many attacks, even without specific security holes. The TCP ports 139 and the new port 445 (used by Win2k and the Samba 3.0 alpha code in particular) should never be exposed to untrusted networks.

II. Impact

A remote attacker may be able to execute arbitrary code with the privileges of the Super User, typically root.

III. Solution

Upgrade to Samba version 2.2.8.

The "Protecting an unpatched Samba server" section of the Samba bulletin discusses several work arounds for unpatched servers.

Systems Affected

Vendor	Status	Date Notified
Apple Computer Inc.	Vulnerable	25-Mar-2003
Conectiva	Vulnerable	17-Mar-2003
Debian	Vulnerable	17-Mar-2003
FreeBSD	Vulnerable	10-Apr-2003
Fujitsu	Not Vulnerable	25-Mar-2003
Gentoo Linux	Vulnerable	17-Mar-2003
Hewlett-Packard Company	Vulnerable	19-Mar-2003
IBM	Vulnerable	10-Apr-2003
Ingrian Networks	Not Vulnerable	17-Mar-2003
MandrakeSoft	Vulnerable	17-Mar-2003
MontaVista Software	Vulnerable	17-Mar-2003
OpenPKG	Vulnerable	19-Mar-2003
Openwall GNU/*/Linux	Not Vulnerable	19-Mar-2003
Red Hat Inc.	Vulnerable	25-Mar-2003
Samba Team	Vulnerable	17-Mar-2003
SGI	Vulnerable	20-Mar-2003
SGI	Unknown	17-Mar-2003
Sun Microsystems Inc.	Vulnerable	15-May-2003
SuSE Inc.	Vulnerable	19-Mar-2003

References

http://www.samba.org/samba/whatsnew/samba-2.2.8.html
http://www.securityfocus.com/bid/7106

Credit

Thanks to Sebastian Krahmer for reporting this vulnerability.

This document was written by Jason A Rafail.

Other Information

Date Public:	2003-03-16
Date First Published:	2003-03-17
Date Last Updated:	2003-05-15
CERT Advisory:
CVE-ID(s):	CAN-2003-0085
NVD-ID(s):	CAN-2003-0085
US-CERT Technical Alerts:
Metric:	23.62
Document Revision:	8

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader