SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (File Transfer/Sharing)  >   Samba Vendors:   Samba.org
(Conectiva Issues Fix) Samba Input Validation Error in ms_fnmatch() Lets Remote Authenticated Users Deny Service
SecurityTracker Alert ID:  1012334
SecurityTracker URL:  http://securitytracker.com/id/1012334
CVE Reference:   CVE-2004-0930   (Links to External Site)
Date:  Nov 26 2004
Impact:   Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 3.0 through 3.0.7
Description:   An input vulnerability was reported in Samba. A remote authenticated user may be able to cause denial of service conditions.

The vendor reported that there is a flaw in the matching of filenames containing wildcard characters. A remote user can cause the target smbd process to consume excessive CPU resources and, in some cases, cause the system to stop responding.

The vendor credits iDEFENSE with reporting this flaw.

iDEFENSE reported that the flaw resides in the ms_fnmatch() function and can be triggered by sending a command that contains multiple asterik characters, such as the following command:

dir ***********************************************z

Impact:   A remote authenticated user can cause excessive CPU consumption on the target system, potentially causing the system to become unresponsive.
Solution:   Conectiva has released a fix.

ftp://atualizacoes.conectiva.com.br/10/SRPMS/samba-3.0.7-62749U10_6cl.src.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/libsmbclient-devel-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/libsmbclient-devel-static-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/libsmbclient0-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-clients-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-common-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-doc-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-server-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-swat-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-testprogs-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-vfs-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-vscan-clamav-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-vscan-fprot-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-vscan-fsecure-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-vscan-kaspersky-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-vscan-mks-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-vscan-oav-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-vscan-sophos-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-vscan-trend-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-winbind-3.0.7-62749U10_6cl.i386.rpm

Vendor URL:  www.samba.org/ (Links to External Site)
Cause:   Input validation error, State error
Underlying OS:  Linux (Conectiva)
Underlying OS Comments:  10

Message History:   This archive entry is a follow-up to the message listed below.
Nov 8 2004 Samba Input Validation Error in ms_fnmatch() Lets Remote Authenticated Users Deny Service



 Source Message Contents

Subject:  [Conectiva-updates] [CLA-2004:899] Conectiva Security Announcement


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
CONECTIVA LINUX SECURITY ANNOUNCEMENT 
- --------------------------------------------------------------------------

PACKAGE   : samba
SUMMARY   : Fix for Samba's denial of service vulnerability
DATE      : 2004-11-25 13:03:00
ID        : CLA-2004:899
RELEVANT
RELEASES  : 10

- -------------------------------------------------------------------------

DESCRIPTION
 Samba[1] provides SMB/CIFS services (such as file and printer
 sharing) used by clients compatible with Microsoft Windows(TM).
 
 Karol Wiesek found a vulnerability[2] in the input validation
 routines in Samba 3.x used to match filename strings containing
 wildcard characters that may allow a remote attacker to consume
 abnormal amounts of CPU cycles.
 
 Also, Steffan Esser found a buffer overflow in the QFILEPATHINFO
 request handler in Samba 3.0.x through 3.0.7 that may allow remote
 attackers to execute arbitrary code via a TRANSACT2_QFILEPATHINFO
 request with a small "maximum data bytes" value.


SOLUTION
 It is recommended that all Samba users upgrade their packages. This
 update will automatically restart the service if it is already
 running.
 
 
 REFERENCES
 1.http://www.samba.org/
 2.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0930
 3.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0882


UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/10/SRPMS/samba-3.0.7-62749U10_6cl.src.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/libsmbclient-devel-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/libsmbclient-devel-static-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/libsmbclient0-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-clients-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-common-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-doc-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-server-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-swat-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-testprogs-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-vfs-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-vscan-clamav-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-vscan-fprot-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-vscan-fsecure-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-vscan-kaspersky-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-vscan-mks-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-vscan-oav-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-vscan-sophos-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-vscan-trend-3.0.7-62749U10_6cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/samba-winbind-3.0.7-62749U10_6cl.i386.rpm


ADDITIONAL INSTRUCTIONS
 The apt tool can be used to perform RPM packages upgrades:

 - run:                 apt-get update
 - after that, execute: apt-get upgrade

 Detailed instructions regarding the use of apt and upgrade examples 
 can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en

- -------------------------------------------------------------------------
All packages are signed with Conectiva's GPG key. The key and instructions
on how to import it can be found at 
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can be
found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en

- -------------------------------------------------------------------------
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en

- -------------------------------------------------------------------------
Copyright (c) 2004 Conectiva Inc.
http://www.conectiva.com

- -------------------------------------------------------------------------
subscribe: conectiva-updates-subscribe@papaleguas.conectiva.com.br
unsubscribe: conectiva-updates-unsubscribe@papaleguas.conectiva.com.br
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQFBpfSJ42jd0JmAcZARAnjKAJ0entsihlbAtF6rRZatDXgUpxtpwgCcDglc
cGURxyBP9zJAFhQmX6az0tU=
=JkF6
-----END PGP SIGNATURE-----

______________________________________________________________________
subscribe: conectiva-updates-subscribe@papaleguas.conectiva.com.br
unsubscribe: conectiva-updates-unsubscribe@papaleguas.conectiva.com.br

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC