SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (File Transfer/Sharing)  >   Samba Vendors:   Samba.org
Samba 'smb.conf' Scripts Input Validation Flaw Lets Remote Users Inject Arbitrary Commands
SecurityTracker Alert ID:  1018051
SecurityTracker URL:  http://securitytracker.com/id/1018051
CVE Reference:   CVE-2007-2447   (Links to External Site)
Date:  May 14 2007
Impact:   Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 3.0.0 - 3.0.25rc3
Description:   A vulnerability was reported in Samba. A remote user can execute arbitrary commands on the target system.

When several scripts defined in 'smb.conf' are invoked, user-supplied input is not properly validated before being passed to '/bin/sh'. A remote user or remote authenticated user can send specially crafted data to execute arbitrary commands on the target system. The code will run with the privileges of the target service.

The 'username map script' option (not a default option) is affected. Other functions are also affected.

The vendor was notified on May 7, 2007.

iDefense Labs reported this vulnerability.

Impact:   A remote user can execute arbitrary commands on the target system.
Solution:   The vendor has issued a patch for Samba 3.0.24, available at:

http://www.samba.org/samba/security/

The Samba advisory is available at:

http://www.samba.org/samba/security/CVE-2007-2447.html

Vendor URL:  www.samba.org/samba/security/CVE-2007-2447.html (Links to External Site)
Cause:   Input validation error
Underlying OS:  Linux (Any), UNIX (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
May 14 2007 (Red Hat Issues Fix) Samba 'smb.conf' Scripts Input Validation Flaw Lets Remote Users Inject Arbitrary Commands
Red Hat has released a fix for Red Hat Enterprise Linux 2.1, 3, 4, and 5.
Jun 5 2007 (HP Issues Fix for HP-UX) Samba 'smb.conf' Scripts Input Validation Flaw Lets Remote Users Inject Arbitrary Commands
HP has issued a fix for CIFS Server on HP-UX 11.11, 11.23, and 11.31.
Jun 21 2007 (HP Issues Fix for Tru64) Samba 'smb.conf' Scripts Input Validation Flaw Lets Remote Users Inject Arbitrary Commands
HP has issued a fix for HP Internet Express for Tru64 UNIX.



 Source Message Contents

Subject:  [SAMBA-SECURITY] CVE-2007-2447: Remote Command Injection Vulnerability

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

==========================================================
==
== Subject:     Remote Command Injection Vulnerability
== CVE ID#:     CVE-2007-2447
==
== Versions:    Samba 3.0.0 - 3.0.25rc3 (inclusive)
==
== Summary:	Unescaped user input parameters are passed
==              as arguments to /bin/sh allowing for remote
==              command execution
==
==========================================================

===========
Description
===========

This bug was originally reported against the anonymous calls
to the SamrChangePassword() MS-RPC function in combination
with the "username map script" smb.conf option (which is not
enabled by default).

After further investigation by Samba developers, it was
determined that the problem was much broader and impacts
remote printer and file share management as well.  The root
cause is passing unfiltered user input provided via MS-RPC
calls to /bin/sh when invoking externals scripts defined
in smb.conf.  However, unlike the "username map script"
vulnerability, the remote file and printer management scripts
require an authenticated user session.


==================
Patch Availability
==================

A patch against Samba 3.0.24 has been posted at

  http://www.samba.org/samba/security/


==========
Workaround
==========

This defect may be alleviated by removing all defined
external script invocations (username map script, add
printer command, etc...) from smb.conf.

The Samba Team always encourages users to run the latest
stable release as a defense against attacks.  If this
is not immediately possible, administrators should read
the "Server Security" documentation found at

  http://www.samba.org/samba/docs/server_security.html


=======
Credits
=======

This vulnerability was  discovered by an anonymous researcher
and reported to Samba developers by Joshua J. Drake, iDefense
Labs (http://www.idefense.com/), as part of their Vulnerability
Contributor Program.

The time line is as follows:

* May 7, 2007: Initial defect disclosure to the security@samba.org
  email alias.
* May 7, 2007: Initial developer response by Samba
  developer Gerald Carter.
* May 9, 2007: Patch released by Samba developer Jeremy
  Allison to iDefense for testing.
* May 10, Announcement to vendor-sec mailing list
* May 14, 2007: Public announcement of the security issue.



==========================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
==========================================================






-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFGR5YAIR7qMdg1EfYRAn91AKDpPgSVlYSbMEkxpIAWG9rD1Cl6kwCffrRO
VCdq+1LtZsACYv7Yt1sQKyE=
=wtvM
-----END PGP SIGNATURE-----

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC