SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (File Transfer/Sharing)  >   Samba Vendors:   Samba.org
Samba Solaris winbindd Daemon Name Resolution Query Buffer Overflows May Let Remtoe Users Execute Arbitrary Code
SecurityTracker Alert ID:  1017589
SecurityTracker URL:  http://securitytracker.com/id/1017589
CVE Reference:   CVE-2007-0453   (Links to External Site)
Date:  Feb 5 2007
Impact:   Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 3.0.21 - 3.0.23d
Description:   A vulnerability was reported in Samba when running on Solaris. A remote user may be able to execute arbitrary code on the target system.

The 'nss_winbind.so.1' library on Solaris contains a buffer overflow in the gethostbyname() and getipnodebyname() functions.

A remote user can cause Samba to make a specially crafted name service resolution query to trigger a buffer overflow and potentially execute arbitrary code on the target system.

Only Sun Solaris systems that use the Samba winbindd daemon and that are configured to use the nss_winbind.so.1 library for gethostbyname() and getipnodebyname() name resolution queries are affected.

The vendor was notified on December 15, 2006.

Olivier Gay reported this vulnerability.

Impact:   A remote user may be able to execute arbitrary code on the target system.
Solution:   The vendor has issued a fixed version (3.0.24). Also, patches for version 3.0.23d are available at:

http://www.samba.org/samba/security

The Samba advisory is available at:

http://us1.samba.org/samba/security/CVE-2007-0453.html

Vendor URL:  us1.samba.org/samba/security/CVE-2007-0453.html (Links to External Site)
Cause:   Boundary error
Underlying OS:  UNIX (Solaris - SunOS)

Message History:   None.


 Source Message Contents

Subject:  [SAMBA-SECURITY] CVE-2007-0453: Buffer overrun in nss_winbind.so.1

This is a multi-part message in MIME format.
--------------060704040606090706050900
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

==========================================================
==
== Subject:     Buffer overrun in NSS host lookup Winbind
==		library on Solaris
== CVE ID#:     CVE-2007-0453
==
== Versions:    Samba 3.0.21 - 3.0.23d (inclusive) running on
==		Sun Solaris
==
== Summary:     A potential overrun in the gethostbyname()
==		and getipnodebyname() in the nss_winbind.so.1
==		library on Solaris can potentially allow
==		for code execution.
==
==========================================================

===========
Description
===========

NOTE: This security advisory only affects Sun Solaris
systems running Samba's winbindd daemon and configured to
make use of the nss_winbind.so.1 library for gethostbyname()
and getipnodebyname() name resolution queries.  For example,

	## /etc/nsswitch.conf
	...
	ipnodes: files winbind
	hosts: files winbind

The buffer overrun is caused by copying a string passed
into the NSS interface into a static buffer prior to sending
the request to the winbindd daemon.


==================
Patch Availability
==================

A patch against Samba 3.0.23d has been attached to this
email.  This fix has be incorporated into the Samba 3.0.24
release.  Patches are also available from at the Samba Security
page (http://www.samba.org/samba/security).

==========
Workaround
==========

An unpatched Solaris server may be protected by removing
the 'winbind' entry from the hosts and ipnodes services in
/etc/nsswitch.conf.


=======
Credits
=======

This vulnerability was reported (including a proposed patch)
to Samba developers by Olivier Gay <ouah@ouah.org>.   Much thanks
to Olivier for his cooperation and patience in the announcement
of this defect.  The time line is as follows:

* Dec 15, 2006: Defect first reported to the security@samba.org
  email alias.
* Dec 21, 2006: Initial developer response by Andrew Tridgell
  confirming the issue.
* Jan 29, 2007: Announcement to vendor-sec mailing list
* Feb 5, 2007: Public issue of security advisory.


==========================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
==========================================================

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFFxzAOIR7qMdg1EfYRAgUoAKCq+KSsNDdpUnToyFtNoMDckMKLHACfet2h
uQ+KAyjI8jTU6nAZHY3v+vI=
=f1TQ
-----END PGP SIGNATURE-----

--------------060704040606090706050900
Content-Type: text/plain; x-mac-type="0"; x-mac-creator="0";
 name="winbind_nss_solaris.patch.asc"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
 filename="winbind_nss_solaris.patch.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (GNU/Linux)

iD8DBQBFvqTIIR7qMdg1EfYRAtaeAJ481DWXPQZcVTGpVT08I3JL3MSa/wCgsrHG
TVy0PqEZqIscoUa0DBegnL4=
=sQHh
-----END PGP SIGNATURE-----













--------------060704040606090706050900
Content-Type: text/plain; x-mac-type="0"; x-mac-creator="0";
 name="winbind_nss_solaris.patch"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
 filename="winbind_nss_solaris.patch"

diff -urN samba-3.0.23d/source/nsswitch/winbind_nss_solaris.c samba/source/nsswitch/winbind_nss_solaris.c
--- samba-3.0.23d/source/nsswitch/winbind_nss_solaris.c	2006-04-19 21:29:21.000000000 -0500
+++ samba/source/nsswitch/winbind_nss_solaris.c	2007-01-29 19:51:11.000000000 -0600
@@ -493,7 +493,8 @@
 	af = AF_INET6;
 #endif
 
-	strncpy(request.data.winsreq, argp->key.name, strlen(argp->key.name)) ;
+	strncpy(request.data.winsreq, argp->key.name, sizeof(request.data.winsreq) - 1);
+	request.data.winsreq[sizeof(request.data.winsreq) - 1] = '\0';
 
 	if( (ret = winbindd_request_response(WINBINDD_WINS_BYNAME, &request, &response))
 		== NSS_STATUS_SUCCESS ) {
@@ -515,7 +516,8 @@
 	ZERO_STRUCT(response);
 	ZERO_STRUCT(request);
 	
-	strncpy(request.data.winsreq, argp->key.name, strlen(argp->key.name));
+	strncpy(request.data.winsreq, argp->key.name, sizeof(request.data.winsreq) - 1);
+	request.data.winsreq[sizeof(request.data.winsreq) - 1] = '\0';
 
 	if( (ret = winbindd_request_response(WINBINDD_WINS_BYNAME, &request, &response))
 		== NSS_STATUS_SUCCESS ) {













--------------060704040606090706050900--

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC