Vulnerability Note VU#958321

Samba contains a remotely exploitable stack buffer overflow

Overview

A remotely exploitable stack buffer overflow exists in the Samba server daemon (smbd).

I. Description

Versions 2.2.2 through 2.2.6 of Samba contain a remotely exploitable stack buffer overflow. The Samba Team describes Samba as follows:

The Samba software suite is a collection of programs that implements the Server Message Block (commonly abbreviated as SMB) protocol for UNIX systems. This protocol is sometimes also referred to as the Common Internet File System (CIFS), LanManager or NetBIOS protocol.

The Samba Team describes the vulnerability as follows:

There was a bug in the length checking for encrypted password change requests from clients. A client could potentially send an encrypted password, which, when decrypted with the old hashed password could be used as a buffer overrun attack on the stack of smbd. The attach would have to be crafted such that converting a DOS codepage string to little endian UCS2 unicode would translate into an executable block of code.

II. Impact

A remote attacker can execute arbitrary code with superuser privileges or can cause smbd to crash.

III. Solution

Apply a patch from your vendor.

Systems Affected

Vendor	Status	Date Notified
Apple Computer Inc.	Not Vulnerable	14-Feb-2003
Conectiva	Vulnerable	13-Dec-2002
Debian	Vulnerable	13-Dec-2002
Gentoo Linux	Vulnerable	13-Dec-2002
Hewlett-Packard Company	Vulnerable	12-Dec-2002
MandrakeSoft	Vulnerable	13-Dec-2002
Red Hat Inc.	Vulnerable	13-Dec-2002
SCO	Vulnerable	5-May-2003
SGI	Vulnerable	13-Dec-2002
Slackware	Vulnerable	13-Dec-2002
Sun Microsystems Inc.	Vulnerable	16-May-2003
SuSE Inc.	Vulnerable	13-Dec-2002
The OpenPKG Project	Vulnerable	13-Dec-2002
Trustix Secure Linux	Vulnerable	13-Dec-2002

References

http://marc.theaimsgroup.com/?l=bugtraq&m=103801986818076&w=2
http://us1.samba.org/samba/whatsnew/samba-2.2.7.html
http://packetstormsecurity.nl/0304-exploits/sambal.c
http://us1.samba.org/samba/docs/man/smbd.8.html
http://se.samba.org/samba/docs/SambaIntro.html
http://www.ciac.org/ciac/bulletins/n-023.shtml
http://www.samba.org/

Credit

This vulnerability was discovered by Steve Langasek and Eloy Paris.

This document was written by Ian A Finlay.

Other Information

Date Public:	2002-11-20
Date First Published:	2002-12-13
Date Last Updated:	2003-05-16
CERT Advisory:
CVE-ID(s):	CAN-2002-1318
NVD-ID(s):	CAN-2002-1318
US-CERT Technical Alerts:
Metric:	45.56
Document Revision:	23

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader