Samba TRANS2_OPEN Buffer Overflow

Description:

There exists a buffer overflow vulnerability in certain versions of Samba that can be exploited if a remote attacker sends an overly long file name to the TRANS2_OPEN call. Successful exploitation yields root privileges.

References:

• BID: http://www.securityfocus.com/bid/7294
• CERT-VN: http://www.kb.cert.org/vuls/id/267873
• CONECTIVA: http://distro.conectiva.com/atualizacoes/?id=a&anuncio=CLA-2003:624
• CVE: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2003-0201
• MANDRAKE: http://www.mandriva.com/security/advisories?name=MDKSA-2003:044
• OVAL: http://oval.mitre.org/oval/definitions/data/OVAL2163.html
• OVAL: http://oval.mitre.org/oval/definitions/data/OVAL567.html
• REDHAT: http://rhn.redhat.com/errata/RHSA-2003-137.html
• SGI: ftp://patches.sgi.com/support/free/security/advisories/20030403-01-P
• SUSE: http://www.novell.com/linux/security/advisories.html
• URL: http://marc.theaimsgroup.com/?l=bugtraq&m=104972664226781&w=2
• URL: http://marc.theaimsgroup.com/?l=bugtraq&m=104974612519064&w=2
• URL: http://marc.theaimsgroup.com/?l=bugtraq&m=104981682014565&w=2
• URL: http://marc.theaimsgroup.com/?l=bugtraq&m=104994564212488&w=2
• URL: http://www.debian.org/security/2003/dsa-280
• URL: http://www.digitaldefense.net/labs/advisories/DDI-1013.txt
  

Solution:

Upgrade to Samba v2.2.8a

Download and apply the upgrade from: http://hostopia.samba.org/samba/ftp/stable/samba-2.2.8a.tar.gz


Information on these pages is summary information extracted from the NeXpose Vulnerabilty Assessment system. Full details are provided within the NeXpose product for licensed users.