Vulnerability Note VU#457622

Samba QFILEPATHINFO handling routine contains a remotely exploitable buffer overflow

Original Release date: 17 Nov 2004 | Last revised: 20 Apr 2005

Overview

Samba is vulnerable to a buffer overflow that may allow a remote attacker to execute arbitrary code with root privileges.

Description

Samba is a widely used open-source implementation of Server Message Block (SMB)/Common Internet File System (CIFS). A lack of bounds checking in the TRANSACT2_QFILEPATHINFO request handling routine may allow a buffer overflow. An attacker can exploit this vulnerability by sending a specially crafted TRANSACT2_QFILEPATHINFO request to a vulnerable Samba server. When the server attempts to create a response, the buffer overflow occurs.

To successfully exploit this vulnerability, the path and file requested must be valid, i.e. the file must exist on the Samba share in the location specified, and the name of the file in the path must contain unicode characters. An attacker with write access to a share could create such a path and filename.

Note an attacker must be authenticated to the Samba server. However, a user with anonymous access may be able to exploit this vulnerability.

According to reports, Samba versions 3.0.7 and prior are vulnerable. Samba version 2.x are not vulnerable.

More detailed information is available in e-matters security advisory 13/2004.

Impact

An remote attacker could execute arbitrary code. The Samba daemon (smbd) typically runs with root privileges, in which case an attacker could gain complete control of a vulnerable system. An attacker may also be able to mount a denial-of-service attack.

Solution

Upgrade Samba


This issue has been corrected in Samba version 3.0.8. Please see the Samba download page for more details.

Restrict Access to Samba

As a general security best practice, restrict access to Samba services to hosts and networks that require those services. Consider blocking Samba traffic at network borders.

Consult Samba Security Guidelines

The Samba Team has a website listing ways to secure a Samba server.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
NEC CorporationAffected17 Nov 200420 Apr 2005
Samba TeamAffected-17 Nov 2004
SuSE Inc.Affected17 Nov 200418 Nov 2004
DebianNot Affected17 Nov 200418 Nov 2004
Juniper NetworksNot Affected17 Nov 200406 Dec 2004
Sun Microsystems Inc.Not Affected17 Nov 200403 Feb 2005
TurboLinuxNot Affected17 Nov 200420 Apr 2005
Apple Computer Inc.Unknown-17 Nov 2004
BSDIUnknown-17 Nov 2004
ConectivaUnknown-17 Nov 2004
Cray Inc.Unknown-17 Nov 2004
EMC CorporationUnknown-17 Nov 2004
EngardeUnknown-17 Nov 2004
F5 NetworksUnknown-17 Nov 2004
FreeBSDUnknown-17 Nov 2004
If you are a vendor and your product is affected, let us know.View More »

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

Thanks to Stefan Esser for reporting this vulnerability.

This document was written by Jeff Gennari.

Other Information

  • CVE IDs: CAN-2004-0882
  • Date Public: 15 Nov 2004
  • Date First Published: 17 Nov 2004
  • Date Last Updated: 20 Apr 2005
  • Severity Metric: 8.62
  • Document Revision: 148

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.