2007年12月11日

[samba-jp:19922] [SECURITY] Buffer overrun in send_mailslot()

太田@NEC です。

セキュリティ対応で3.0.28 が出るようです。

----- Forwarded message from "Gerald (Jerry) Carter" <jerry@xxxxx> -----

Date: Mon, 10 Dec 2007 07:49:18 -0600
From: "Gerald (Jerry) Carter" <jerry@xxxxx>

To: samba@xxxxx
Subject: [Samba] [SECURITY] Buffer overrun in send_mailslot()

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

==========================================================
==
== Subject: Boundary failure in GETDC mailslot
== processing can result in a buffer overrun
==
== CVE ID#: CVE-2007-6015
==
== Versions: Samba 3.0.0 - 3.0.27a (inclusive)
==
== Summary: Specifically crafted GETDC mailslot requests
== can trigger a boundary error in the domain
== controller GETDC mail slot support which
== can be remotely exploited to execute arbitrary
== code.
==
==========================================================

===========
Description
===========

Secunia Research reported a vulnerability that allows for
the execution of arbitrary code in nmbd. This defect is
only be exploited when the "domain logons" parameter has
been enabled in smb.conf.


==================
Patch Availability
==================

A patch addressing this defect has been posted to

http://www.samba.org/samba/security/

Additionally, Samba 3.0.28 has been issued as a security
release to correct the defect.


==========
Workaround
==========

Samba administrators may avoid this security issue by disabling
both the "domain logons" options in the server's smb.conf file.
Note that this will disable all domain controller features as
well.


=======
Credits
=======

This vulnerability was reported to Samba developers by
Alin Rad Pop, Secunia Research.

The time line is as follows:

* Nov 22, 2007: Initial report to security@xxxxx
* Nov 22, 2007: First response from Samba developers confirming
the bug along with a proposed patch.
* Dec 10, 2007: Public security advisory made available.


==========================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
==========================================================

--
太田 俊哉@NEC OSS開本 OSS推進センター OSS/LinuxソリューションG(芝.港.東京)
(samba-jp/ldap-jp Staff,mutt-j admin,analog-jp/samba-jp postmaster)

投稿者 xml-rpc : 2007年12月11日 10:03
役に立ちました?:
過去のフィードバック 平均:(0) 総合:(0) 投票回数:(0)
本記事へのTrackback: http://hoop.euqset.org/blog/mt-tb2006.cgi/67518
トラックバック
コメント
コメントする




画像の中に見える文字を入力してください。