lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 10 Dec 2007 07:50:40 -0600
From: "Gerald (Jerry) Carter" <jerry@...ba.org>
To: bugtraq@...urityfocus.com
Cc: security@...ba.org
Subject: [SECURITY] Buffer overrun in send_mailslot()

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

==========================================================
==
== Subject:     Boundary failure in GETDC mailslot
==              processing can result in a buffer overrun
==
== CVE ID#:     CVE-2007-6015
==
== Versions:    Samba 3.0.0 - 3.0.27a (inclusive)
==
== Summary:     Specifically crafted GETDC mailslot requests
==              can trigger a boundary error in the domain
==              controller GETDC mail slot support which
==              can be remotely exploited to execute arbitrary
==              code.
==
==========================================================

===========
Description
===========

Secunia Research reported a vulnerability that allows for
the execution of arbitrary code in nmbd.  This defect is
only be exploited when the "domain logons" parameter has
been enabled in smb.conf.


==================
Patch Availability
==================

A patch addressing this defect has been posted to

  http://www.samba.org/samba/security/

Additionally, Samba 3.0.28 has been issued as a security
release to correct the defect.


==========
Workaround
==========

Samba administrators may avoid this security issue by disabling
both the "domain logons" options in the server's smb.conf file.
Note that this will disable all domain controller features as
well.


=======
Credits
=======

This vulnerability was reported to Samba developers by
Alin Rad Pop, Secunia Research.

The time line is as follows:

* Nov 22, 2007: Initial report to security@...ba.org.
* Nov 22, 2007: First response from Samba developers confirming
  the bug along with a proposed patch.
* Dec 10, 2007: Public security advisory made available.


==========================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
==========================================================
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFHXUQvIR7qMdg1EfYRArG0AJ9hSIu3s0AMtbgeaGDMTbSOXtA6ywCfSypz
T9GCNlOUVnZ2O25IOXQOzLk=
=cISn
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux - Powered by OpenVZ