Gerald Carter
2004-Dec-16 12:18 UTC
[Samba] CAN-2004-1154 : Integer overflow could lead to remote code execution in Samba 2.x, 3.0.x <= 3.0.9
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================ Subject: Possible remote code execution == CVE ID#: CAN-2004-1154 === Versions: Samba 2.x & 3.0.x <= 3.0.9 === Summary: A potential integer overflow when == unmarshalling specific MS-RPC requests == from clients could lead to heap == corruption and remote code execution. ========================================================== ==========Description ========== Remote exploitation of an integer overflow vulnerability in the smbd daemon included in Samba 2.0.x, Samba 2.2.x, and Samba 3.0.x prior to and including 3.0.9 could allow an attacker to cause controllable heap corruption, leading to execution of arbitrary commands with root privileges. Successful remote exploitation allows an attacker to gain root privileges on a vulnerable system. In order to exploit this vulnerability an attacker must possess credentials that allow access to a share on the Samba server. Unsuccessful exploitation attempts will cause the process serving the request to crash with signal 11, and may leave evidence of an attack in logs. =================Patch Availability ================= A patch for Samba 3.0.9 (samba-3.0.9-CAN-2004-1154.patch) can be downloaded from http://www.samba.org/samba/ftp/patches/security/ The patch has been signed with the "Samba Distribution Verification Key" (ID F17F9772). ============================Protecting Unpatched Servers ============================ The Samba Team always encourages users to run the latest stable release as a defense against attacks. However, under certain circumstances it may not be possible to immediately upgrade important installations. In such cases, administrators should read the "Server Security" documentation found at http://www.samba.org/samba/docs/server_security.html. ======Credits ====== This security issue was reported to Samba developers by iDEFENSE Labs. The vulnerability was discovered by Greg MacManus, iDEFENSE Labs. =========================================================== Our Code, Our Bugs, Our Responsibility. == The Samba Team ========================================================= -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFBwXzdIR7qMdg1EfYRAvnVAKCgJxELPsRo2oIwBcUq+wKNkjB3BwCgzn5l 3PtHselUE/u/xxC7PRYpxyA=8JRM -----END PGP SIGNATURE-----
David Schlenk
2004-Dec-16 16:18 UTC
[Samba] CAN-2004-1154 : Integer overflow could lead to remote code execution in Samba 2.x, 3.0.x <= 3.0.9
Today's security patch doesn't work if you also want to use the printing patch for 3.0.9 mentioned recently on this list. Build error: Linking bin/smbd printing/printing.o(.text+0x2d4b): In function `print_queue_update': printing/printing.c:1421: undefined reference to `smb_xmalloc' collect2: ld returned 1 exit status make: *** [bin/smbd] Error 1 This is patching with the printing patch first, followed by the security patch, using the %patch macros of rpm. I'll try the other way around, but it takes awhile on my slow test box, so I thought I'd see if anyone had any success building with both patches. On Dec 16, 2004, at 6:17 AM, Gerald Carter wrote:> -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > =========================================================> => == Subject: Possible remote code execution > == CVE ID#: CAN-2004-1154 > => == Versions: Samba 2.x & 3.0.x <= 3.0.9 > => == Summary: A potential integer overflow when > == unmarshalling specific MS-RPC requests > == from clients could lead to heap > == corruption and remote code execution. > => =========================================================> > > ==========> Description > ==========> > Remote exploitation of an integer overflow vulnerability > in the smbd daemon included in Samba 2.0.x, Samba 2.2.x, > and Samba 3.0.x prior to and including 3.0.9 could > allow an attacker to cause controllable heap corruption, > leading to execution of arbitrary commands with root > privileges. > > Successful remote exploitation allows an attacker to > gain root privileges on a vulnerable system. In order > to exploit this vulnerability an attacker must possess > credentials that allow access to a share on the Samba server. > Unsuccessful exploitation attempts will cause the process > serving the request to crash with signal 11, and may leave > evidence of an attack in logs. > > > =================> Patch Availability > =================> > A patch for Samba 3.0.9 (samba-3.0.9-CAN-2004-1154.patch) > can be downloaded from > > http://www.samba.org/samba/ftp/patches/security/ > > The patch has been signed with the "Samba Distribution > Verification Key" (ID F17F9772). > > > ============================> Protecting Unpatched Servers > ============================> > The Samba Team always encourages users to run the latest > stable release as a defense against attacks. However, > under certain circumstances it may not be possible to > immediately upgrade important installations. In such > cases, administrators should read the "Server Security" > documentation found at > > http://www.samba.org/samba/docs/server_security.html. > > > ======> Credits > ======> > This security issue was reported to Samba developers by > iDEFENSE Labs. The vulnerability was discovered by Greg > MacManus, iDEFENSE Labs. > > > =========================================================> == Our Code, Our Bugs, Our Responsibility. > == The Samba Team > =========================================================> > > > > > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.2.4 (GNU/Linux) > Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org > > iD8DBQFBwXzdIR7qMdg1EfYRAvnVAKCgJxELPsRo2oIwBcUq+wKNkjB3BwCgzn5l > 3PtHselUE/u/xxC7PRYpxyA> =8JRM > -----END PGP SIGNATURE----- > > -- > To unsubscribe from this list go to the following URL and read the > instructions: https://lists.samba.org/mailman/listinfo/samba >-- David Schlenk Operating Systems Analyst Bethel University Saint Paul, Minnesota david-schlenk@bethel.edu