Gerald (Jerry) Carter
2004-Nov-08 17:52 UTC
[Samba] [SECURITY] CAN-2004-0930: Potential Remote Denial of Service Vulnerability in Samba 3.0.x <= 3.0.7
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Subject: Potential Remote Denial of Service CVE #: CAN-2004-0930 Affected Versions: Samba 3.0.x <= 3.0.7 Summary: A remote attacker could cause and smbd process to consume abnormal amounts of system resources due to an input validation error when matching filenames containing wildcard characters. Patch Availability - ------------------ A patch for Samba 3.0.7 (samba-3.0.7-CAN-2004-0930.patch) is available from http://www.samba.org/samba/ftp/patches/security/. The patch has been signed with the "Samba Distribution Verification Key" (ID F17F9772). Description - ----------- A bug in the input validation routines used to match filename strings containing wildcard characters may allow a user to consume more than normal amounts of CPU cycles thus impacting the performance and response of the server. In some circumstances the server can become entirely unresponsive. Protecting Unpatched Servers - ---------------------------- The Samba Team always encourages users to run the latest stable release as a defense of against attacks. However, under certain circumstances it may not be possible to immediately upgrade important installations. In such cases, administrators should read the "Server Security" documentation found at http://www.samba.org/samba/docs/server_security.html. Credits - -------- This security issue was reported to Samba developers by iDEFENSE (http://www.idefense.com/). Karol Wiesek is credited with this discovery. - -- Our Code, Our Bugs, Our Responsibility. -- The Samba Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFBj7IsIR7qMdg1EfYRAnNMAKCDKh50RrTtn9w7O4tTCxUcXA1lngCgkhQt Pf/TvEhiUpK6ilVkRFF4xh0=O2iZ -----END PGP SIGNATURE-----