[Full-Disclosure] [ GLSA 200409-16 ] Samba: Denial of Service vulnerabilities

From: Sune Kloppenborg Jeppesen (jaervosz_at_gentoo.org)
Date: 09/13/04

  • Next message: advisories: "[Full-Disclosure] Corsaire Security Advisory - Multiple vendor MIME RFC2047 encoding issue" 
    To: gentoo-announce@gentoo.org
Date: Mon, 13 Sep 2004 15:14:45 +0200

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Gentoo Linux Security Advisory GLSA 200409-16
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                                http://security.gentoo.org/
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

      Severity: Normal
         Title: Samba: Denial of Service vulnerabilities
          Date: September 13, 2004
            ID: 200409-16

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Synopsis
    ========

    Two Denial of Service vulnerabilities have been found and fixed in
    Samba.

    Background
    ==========

    Samba is a freely available SMB/CIFS implementation which allows
    seamless interoperability of file and print services to other SMB/CIFS
    clients. smbd and nmbd are two daemons used by the Samba server.

    Affected packages
    =================

        -------------------------------------------------------------------
         Package / Vulnerable / Unaffected
        -------------------------------------------------------------------
      1 net-fs/samba < 3.0.7 >= 3.0.7
                                                                     < 3.0

    Description
    ===========

    There is a defect in smbd's ASN.1 parsing. A bad packet received during
    the authentication request could throw newly-spawned smbd processes
    into an infinite loop (CAN-2004-0807). Another defect was found in
    nmbd's processing of mailslot packets, where a bad NetBIOS request
    could crash the nmbd process (CAN-2004-0808).

    Impact
    ======

    A remote attacker could send specially crafted packets to trigger both
    defects. The ASN.1 parsing issue can be exploited to exhaust all
    available memory on the Samba host, potentially denying all service to
    that server. The nmbd issue can be exploited to crash the nmbd process,
    resulting in a Denial of Service condition on the Samba server.

    Workaround
    ==========

    There is no known workaround at this time.

    Resolution
    ==========

    All Samba 3.x users should upgrade to the latest version:

        # emerge sync

        # emerge -pv ">=net-fs/samba-3.0.7"
        # emerge ">=net-fs/samba-3.0.7"

    References
    ==========

      [ 1 ] CAN-2004-0807
            http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0807
      [ 2 ] CAN-2004-0808
            http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0808

    Availability
    ============

    This GLSA and any updates to it are available for viewing at
    the Gentoo Security Website:

      http://security.gentoo.org/glsa/glsa-200409-16.xml

    Concerns?
    =========

    Security is a primary focus of Gentoo Linux and ensuring the
    confidentiality and security of our users machines is of utmost
    importance to us. Any security concerns should be addressed to
    security@gentoo.org or alternatively, you may file a bug at
    http://bugs.gentoo.org.

    License
    =======

    Copyright 2004 Gentoo Foundation, Inc; referenced text
    belongs to its owner(s).

    The contents of this document are licensed under the
    Creative Commons - Attribution / Share Alike license.

    http://creativecommons.org/licenses/by-sa/1.0

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: advisories: "[Full-Disclosure] Corsaire Security Advisory - Multiple vendor MIME RFC2047 encoding issue"

    Relevant Pages

    • [UNIX] Security Bugfix for Samba (SMB/CIFS Overflow)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... running a Samba server. ... The above will only allow SMB connections from 'localhost' (your own ... Fix delete on close semantics to match W2K. ...
      (Securiteam)
    • [ GLSA 200409-16 ] Samba: Denial of Service vulnerabilities
      ... Samba is a freely available SMB/CIFS implementation which allows ... The nmbd issue can be exploited to crash the nmbd process, ... Security is a primary focus of Gentoo Linux and ensuring the ...
      (Bugtraq)
    • [ GLSA 200409-16 ] Samba: Denial of Service vulnerabilities
      ... Samba is a freely available SMB/CIFS implementation which allows ... The nmbd issue can be exploited to crash the nmbd process, ... Security is a primary focus of Gentoo Linux and ensuring the ...
      (Full-Disclosure)
    • [UNIX] Buffer Overflow in Samba allows remote root compromise
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... off of the Samba source tree, and aims at being a substitute for a Windows ... A buffer overflow vulnerability in the Samba daemon allows an attacker to ...
      (Securiteam)
    • Re: CIFS on VMS, multi-user share per user security setup question
      ... and 'connects as another user' to log in to the samba ... When I added new sets of ACEs for the CIFS identifiers of each of the ... any other account had created. ... Another item is attempting to modify the security profile from the ...
      (comp.os.vms)
    • Quantcast