(Conectiva Issues Fix) Samba Input Validation Error in ms_fnmatch() Lets Remote Authenticated Users Deny Service
|
|
SecurityTracker Alert ID: 1012334 |
|
SecurityTracker URL: http://securitytracker.com/id/1012334
|
|
CVE Reference:
CVE-2004-0930
(Links to External Site)
|
Date: Nov 26 2004
|
Impact:
Denial of service via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 3.0 through 3.0.7
|
Description:
An input vulnerability was reported in Samba. A remote authenticated user may be able to cause denial of service conditions.
The vendor reported that there is a flaw in the matching of filenames containing wildcard characters. A remote user can cause the target smbd process to consume excessive CPU resources and, in some cases, cause the system to stop responding.
The vendor credits iDEFENSE with reporting this flaw.
iDEFENSE reported that the flaw resides in the ms_fnmatch() function and can be triggered by sending a command that contains multiple asterik characters, such as the following command:
dir ***********************************************z
|
Impact:
A remote authenticated user can cause excessive CPU consumption on the target system, potentially causing the system to become unresponsive.
|
Solution:
Conectiva has released a fix.
ftp://atualizacoes.conectiva.com.br/10/SRPMS/samba-3.0.7-62749U10_6cl.src.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/libsmbclient-devel-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/libsmbclient-devel-static-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/libsmbclient0-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-clients-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-common-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-doc-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-server-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-swat-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-testprogs-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-vfs-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-vscan-clamav-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-vscan-fprot-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-vscan-fsecure-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-vscan-kaspersky-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-vscan-mks-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-vscan-oav-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-vscan-sophos-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-vscan-trend-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-winbind-3.0.7-62749U10_6cl.i386.rpm
|
Vendor URL: www.samba.org/ (Links to External Site)
|
Cause:
Input validation error, State error
|
Underlying OS:
Linux (Conectiva)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Thu, 25 Nov 2004 13:04:42 -0200
Subject: [Conectiva-updates] [CLA-2004:899] Conectiva Security Announcement
|
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- --------------------------------------------------------------------------
CONECTIVA LINUX SECURITY ANNOUNCEMENT
- --------------------------------------------------------------------------
PACKAGE : samba
SUMMARY : Fix for Samba's denial of service vulnerability
DATE : 2004-11-25 13:03:00
ID : CLA-2004:899
RELEVANT
RELEASES : 10
- -------------------------------------------------------------------------
DESCRIPTION
Samba[1] provides SMB/CIFS services (such as file and printer
sharing) used by clients compatible with Microsoft Windows(TM).
Karol Wiesek found a vulnerability[2] in the input validation
routines in Samba 3.x used to match filename strings containing
wildcard characters that may allow a remote attacker to consume
abnormal amounts of CPU cycles.
Also, Steffan Esser found a buffer overflow in the QFILEPATHINFO
request handler in Samba 3.0.x through 3.0.7 that may allow remote
attackers to execute arbitrary code via a TRANSACT2_QFILEPATHINFO
request with a small "maximum data bytes" value.
SOLUTION
It is recommended that all Samba users upgrade their packages. This
update will automatically restart the service if it is already
running.
REFERENCES
1.http://www.samba.org/
2.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0930
3.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0882
UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/10/SRPMS/samba-3.0.7-62749U10_6cl.src.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/libsmbclient-devel-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/libsmbclient-devel-static-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/libsmbclient0-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-clients-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-common-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-doc-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-server-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-swat-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-testprogs-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-vfs-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-vscan-clamav-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-vscan-fprot-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-vscan-fsecure-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-vscan-kaspersky-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-vscan-mks-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-vscan-oav-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-vscan-sophos-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-vscan-trend-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-winbind-3.0.7-62749U10_6cl.i386.rpm
ADDITIONAL INSTRUCTIONS
The apt tool can be used to perform RPM packages upgrades:
- run: apt-get update
- after that, execute: apt-get upgrade
Detailed instructions regarding the use of apt and upgrade examples
can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en
- -------------------------------------------------------------------------
All packages are signed with Conectiva's GPG key. The key and instructions
on how to import it can be found at
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can be
found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en
- -------------------------------------------------------------------------
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en
- -------------------------------------------------------------------------
Copyright (c) 2004 Conectiva Inc.
http://www.conectiva.com
- -------------------------------------------------------------------------
subscribe: conectiva-updates-subscribe@papaleguas.conectiva.com.br
unsubscribe: conectiva-updates-unsubscribe@papaleguas.conectiva.com.br
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org
iD8DBQFBpfSJ42jd0JmAcZARAnjKAJ0entsihlbAtF6rRZatDXgUpxtpwgCcDglc
cGURxyBP9zJAFhQmX6az0tU=
=JkF6
-----END PGP SIGNATURE-----
______________________________________________________________________
subscribe: conectiva-updates-subscribe@papaleguas.conectiva.com.br
unsubscribe: conectiva-updates-unsubscribe@papaleguas.conectiva.com.br
|
|
