bugtraq - [SAMBA] CVE-2007-5398 - Remote Code Execution in Samba's nmbd

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <473C47BB.8050404@samba.org>
Date: Thu, 15 Nov 2007 07:20:59 -0600
From: "Gerald (Jerry) Carter" <jerry@...ba.org>
To: bugtraq@...urityfocus.com
Cc: security@...ba.org
Subject: [SAMBA] CVE-2007-5398 - Remote Code Execution in Samba's nmbd

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

==========================================================
==
== Subject:     Remote code execution in Samba's WINS
==              server daemon (nmbd) when processing name
==              registration followed name query requests.
==
== CVE ID#:     CVE-2007-5398
==
== Versions:    Samba 3.0.0 - 3.0.26a (inclusive)
==
== Summary:     When nmbd has been configured as a WINS
==              server, a client can send a series of name
==              registration request followed by a specific
==              name query request packet and execute
==              arbitrary code.
==
==========================================================

===========
Description
===========

Secunia Research reported a vulnerability that allows for
the execution of arbitrary code in nmbd.  This defect may
only be exploited when the "wins support" parameter has
been enabled in smb.conf.

==================
Patch Availability
==================

A patch addressing this defect has been posted to

  http://www.samba.org/samba/security/

Additionally, Samba 3.0.27 has been issued as a security
release to correct the defect.

==========
Workaround
==========

Samba administrators may avoid this security issue by
disabling the "wins support" feature in the hosts smb.conf
file.

=======
Credits
=======

This vulnerability was reported to Samba developers by
Alin Rad Pop, Secunia Research.

The time line is as follows:

* Oct 30, 2007: Initial report to security@...ba.org.
* Oct 30, 2007: First response from Samba developers confirming
  the bug along with a proposed patch.
* Nov 15, 2007: Public security advisory to be made available.

==========================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
==========================================================
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFHPEe6IR7qMdg1EfYRAqoAAJsHFk1kScYHweqRny4PP4ngQaFo7QCdElle
Cv+e7K/AE69rXcmeU67jHzQ=
=9Wap
-----END PGP SIGNATURE-----