SAMBA Users should apply this patch ASAP

If you use SAMBA 3.0.7 or prior (appears, 2.x is not vulnerable) you should read this https://www.kb.cert.org/vuls/id/457622, here's a snippet:

Vulnerability Note VU#457622

Samba QFILEPATHINFO handling routine contains a remotely exploitable buffer overflow

Overview

Samba is vulnerable to a buffer overflow that may allow a remote attacker to execute arbitrary code with root privileges.

I. Description

Samba is a widely used open-source implementation of Server Message Block (SMB)/Common Internet File System (CIFS). A lack of bounds checking in the TRANSACT2_QFILEPATHINFO request handling routine may allow a buffer overflow. An attacker can exploit this vulnerability by sending a specially crafted TRANSACT2_QFILEPATHINFO request to a vulnerable Samba server. When the server attempts to create a response, the buffer overflow occurs.

To successfully exploit this vulnerability, the path and file requested must be valid, i.e. the file must exist on the Samba share in the location specified, and the name of the file in the path must contain unicode characters. An attacker with write access to a share could create such a path and filename.

Note an attacker must authenticated to the Samba server. However, a user with anonymous access may be able to exploit this vulnerability.

According to reports, Samba versions 3.0.7 and prior are vulnerable. Samba version 2.x are not vulnerable.

More detailed information is available in e-matters security advisory 13/2004.

II. Impact

An remote attacker could execute arbitrary code. The Samba daemon (smbd) typically runs with root privileges, in which case an attacker could gain complete control of a vulnerable system. An attacker may also be able to mount a denial-of-service attack.

Comments

• Anonymous
  November 29, 2004
  Thanks for the great idea! :)