SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com






Category:   Application (File Transfer/Sharing)  >   Samba Vendors:   Samba.org
Samba Input Validation Error in ms_fnmatch() Lets Remote Authenticated Users Deny Service
SecurityTracker Alert ID:  1012133
SecurityTracker URL:  http://securitytracker.com/id/1012133
CVE Reference:   CVE-2004-0930   (Links to External Site)
Updated:  Oct 18 2006
Original Entry Date:  Nov 8 2004
Impact:   Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): 3.0 through 3.0.7
Description:   An input vulnerability was reported in Samba. A remote authenticated user may be able to cause denial of service conditions.

The vendor reported that there is a flaw in the matching of filenames containing wildcard characters. A remote user can cause the target smbd process to consume excessive CPU resources and, in some cases, cause the system to stop responding.

The vendor credits iDEFENSE with reporting this flaw.

iDEFENSE reported that the flaw resides in the ms_fnmatch() function and can be triggered by sending a command that contains multiple asterik characters, such as the following command:

dir ***********************************************z

Impact:   A remote authenticated user can cause excessive CPU consumption on the target system, potentially causing the system to become unresponsive.
Solution:   A patch for Samba 3.0.7 (samba-3.0.7-CAN-2004-0930.patch) is available at:

http://www.samba.org/samba/ftp/patches/security/

The patch has been signed with the "Samba Distribution Verification Key" (ID F17F9772).

Vendor URL:  www.samba.org/ (Links to External Site)
Cause:   Input validation error, State error
Underlying OS:   Linux (Any), UNIX (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
Nov 11 2004 (Mandrake Issues Fix) Samba Input Validation Error in ms_fnmatch() Lets Remote Authenticated Users Deny Service   (Mandrake Linux Security Team <security@linux-mandrake.com>)
Mandrake has released a fix.
Nov 12 2004 (Gentoo Issues Fix) Samba Input Validation Error in ms_fnmatch() Lets Remote Authenticated Users Deny Service   (Matthias Geerdsen <vorlon@gentoo.org>)
Gentoo has released a fix.
Nov 19 2004 (Red Hat Issues Fix) Samba Input Validation Error in ms_fnmatch() Lets Remote Authenticated Users Deny Service   (bugzilla@redhat.com)
Red Hat has released a fix for Red Hat Enterprise Linux 2.1 and 3.
Nov 26 2004 (Conectiva Issues Fix) Samba Input Validation Error in ms_fnmatch() Lets Remote Authenticated Users Deny Service   (Conectiva Updates <secure@conectiva.com.br>)
Conectiva has released a fix.
Nov 30 2004 (Fedora Issues Fix for FC2) Samba Input Validation Error in ms_fnmatch() Lets Remote Authenticated Users Deny Service   (Jay Fenlason <fenlason@redhat.com>)
Fedora has released a fix for Fedora Core 2.
Nov 30 2004 (Fedora Issues Fix for FC3) Samba Input Validation Error in ms_fnmatch() Lets Remote Authenticated Users Deny Service   (Jay Fenlason <fenlason@redhat.com>)
Fedora has released a fix for Fedora Core 3.
Jun 24 2005 (Sun Issues Fix) Samba Input Validation Error in ms_fnmatch() Lets Remote Authenticated Users Deny Service
Sun has issued a fix for Solaris 9 and 10.



 Source Message Contents

Date:  Mon, 08 Nov 2004 11:45:02 -0600
Subject:  [SECURITY] CAN-2004-0930: Potential Remote Denial of Service Vulnerability


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Subject:	Potential Remote Denial of Service
CVE #:		CAN-2004-0930
Affected
Versions:	Samba 3.0.x <= 3.0.7

Summary:	A remote attacker could cause and smbd process
		to consume abnormal amounts of system resources
		due to an input validation error when matching
		filenames containing wildcard characters.


Patch Availability
- ------------------

A patch for Samba 3.0.7 (samba-3.0.7-CAN-2004-0930.patch) is
available from http://www.samba.org/samba/ftp/patches/security/.
The patch has been signed with the "Samba Distribution Verification
Key"  (ID F17F9772).


Description
- -----------

A bug in the input validation routines used to match
filename strings containing wildcard characters may allow
a user to consume more than normal amounts of CPU cycles
thus impacting the performance and response of the server.
In some circumstances the server can become entirely
unresponsive.


Protecting Unpatched Servers
- ----------------------------

The Samba Team always encourages users to run the latest stable
release as a defense of against attacks.  However, under certain
circumstances it may not be possible to immediately upgrade
important installations.  In such cases, administrators should
read the "Server Security" documentation found at
http://www.samba.org/samba/docs/server_security.html.


Credits
- --------

This security issue was reported to Samba developers by
iDEFENSE (http://www.idefense.com/).  Karol Wiesek is credited
with this discovery.



- --
Our Code, Our Bugs, Our Responsibility.

				-- The Samba Team
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFBj7CeIR7qMdg1EfYRAj+MAKDNkcUR/2ty7ImGmQQgMyJmJL2PXwCgguGr
bT7+yChNg9Sg++7fdexNg9g=
=WfWT
-----END PGP SIGNATURE-----

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

Copyright 2014, SecurityGlobal.net LLC