[Samba-it] [Fwd: [SECURITY] CAN-2004-0882: Possible Buffer Overrun in smbd]

Simo Sorce simo.sorce at xsec.it
Mon Nov 15 14:09:01 MST 2004


-----Forwarded Message-----
From: Gerald (Jerry) Carter <jerry at samba.org>
To: samba-technical at samba.org
Subject: [SECURITY] CAN-2004-0882: Possible Buffer Overrun in smbd
Date: Mon, 15 Nov 2004 06:58:31 -0600

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Subject:       Possible Buffer Overrun in smbd
CVE #: CAN-2004-0882
Affected
Versions:      Samba 3.0.x <= 3.0.7

Summary:       A possible buffer overrun in smbd could
	       lead to code execution by a remote user


Patch Availability
- ------------------

A patch for Samba 3.0.7 (samba-3.0.7-CAN-2004-0882.patch) is
available from http://www.samba.org/samba/ftp/patches/security/.
The patch has been signed with the "Samba Distribution Verification
Key"  (ID F17F9772).


Description
- -----------

Invalid bounds checking in reply to certain trans2 requests
could result in a buffer overrun in smbd.  In order to exploit
this defect, the attacker must be able to create files with very
specific Unicode filenames on the Samba share.


Protecting Unpatched Servers
- - ----------------------------

The Samba Team always encourages users to run the latest stable
release as a defense of against attacks.  However, under certain
circumstances it may not be possible to immediately upgrade
important installations.  In such cases, administrators should
read the "Server Security" documentation found at
http://www.samba.org/samba/docs/server_security.html.


Credits
- --------

This security issue was reported to Samba developers by Stefan
Esser from e-matters Security (http://security.e-matters.de/).



- -- Our Code, Our Bugs, Our Responsibility.

       -- The Samba Team
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: For info see http://quantumlab.net/pine_privacy_guard/

iD8DBQFBmKf9IR7qMdg1EfYRAmOwAKDN7cyei0pjWqSD2U0ahC+dVSKfhwCfQtHM
WGFHieYWqTxfJFgEy9uHqpE=
=BwaS
-----END PGP SIGNATURE-----
-- 
Simo Sorce - simo.sorce at xsec.it
Xsec s.r.l. - http://www.xsec.it
via Garofalo, 39 - 20133 - Milano
mobile: +39 329 328 7702
tel. +39 02 2953 4143 - fax: +39 02 700 442 399




More information about the samba-it mailing list