Home    |    View Topics    |    Search    |    Contact Us    |   



Category:   Application (File Transfer/Sharing)  >   Samba Vendors:
Samba Format String Bug in '' VFS Plugin May Let Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1017588
SecurityTracker URL:
CVE Reference:   CVE-2007-0454   (Links to External Site)
Date:  Feb 5 2007
Impact:   Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 3.0.6 - 3.0.23d
Description:   A vulnerability was reported in Samba in the AFS ACL mapping VFS plugin. A remote user can cause arbitrary code to be executed on the target user's system.

A remote user can create a specially crafted file name on the server's share to cause arbitrary code to be executed on the target system. The file name is used as the format string specifier when setting an NT security descriptor via the '' VFS plugin.

Only systems that share AFS file systems to CIFS clients and that are configured (in the 'smb.conf' file) to load the '' VFS module are affected.

The vendor was notified on January 8, 2007.

zybadawg333 at reported this vulnerability.

Impact:   A remote user can create a file that will cause arbitrary code to be executed on the target system.
Solution:   The vendor has issued a fixed version (3.0.24). Also, patches for version 3.0.23d are available at:

The Samba advisory is available at:

Vendor URL: (Links to External Site)
Cause:   Boundary error
Underlying OS:  Linux (Any), UNIX (Any)

Message History:   None.

 Source Message Contents

Subject:  [SAMBA-SECURITY] CVE-2007-0454: Format string bug in VFS

This is a multi-part message in MIME format.
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

Hash: SHA1

== Subject:     Format string bug in VFS plugin.
== CVE ID#:     CVE-2007-0454
== Versions:    The AFS ACL mapping VFS plugin distributed
==		in Samba 3.0.6 - 3.0.23d (inclusive)
== Summary:     The name of a file on the server's share
==		is used as the format string when setting
==		an NT security descriptor through the
== VFS plugin.


NOTE: This security advisory only impacts Samba servers
that share AFS file systems to CIFS clients and which have
been explicitly instructed in smb.conf to load the
VFS module.

The source defect results in the name of a file stored on
disk being used as the format string in a call to snprintf().
This bug becomes exploitable only when a user is able
to write to a share which utilizes Samba's library
for setting Windows NT access control lists on files residing
on an AFS file system.

Patch Availability

A patch against Samba 3.0.23d has been attached to this
email.  This fix has be incorporated into the Samba 3.0.24
release.  Patches are also available from at the Samba Security
page (


An unpatched server may be protected by removing all
references to the VFS module from shares in


This vulnerability was reported (including a proposed patch)
to Samba developers by <>.  Much thanks
to zybadawg333 for the cooperation and patience in the
announcement of this defect.  The time line is as follows:

* Jan 8, 2007: Defect first reported to the
  email alias.
* Jan 8, 2007: Initial developer response by Jeremy Allison
  confirming the issue.
* Jan 29, 2007: Announcement to vendor-sec mailing list
* Feb 5, 2007: Public issue of security advisory.

== Our Code, Our Bugs, Our Responsibility.
== The Samba Team

Version: GnuPG v1.4.3 (GNU/Linux)
Comment: Using GnuPG with Mozilla -


Content-Type: text/plain; x-mac-type="0"; x-mac-creator="0";
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;

diff -urN samba-3.0.23d/source/modules/vfs_afsacl.c samba/source/modules/vfs_afsacl.c
--- samba-3.0.23d/source/modules/vfs_afsacl.c	2006-06-23 08:16:50.000000000 -0500
+++ samba/source/modules/vfs_afsacl.c	2007-01-29 20:11:07.000000000 -0600
@@ -901,7 +901,7 @@
-	pstr_sprintf(name, fsp->fsp_name);
+	pstrcpy(name, fsp->fsp_name);
 	if (!fsp->is_directory) {
 		/* We need to get the name of the directory containing the

Content-Type: text/plain; x-mac-type="0"; x-mac-creator="0";
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;

Version: GnuPG v1.4.3 (GNU/Linux)




Go to the Top of This SecurityTracker Archive Page

Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2022, LLC