According to its banner, the version of the Samba server on the remote host is reportedly affected by a boundary error in 'nmbd' within the 'receive_smb_raw' function in 'lib/util_sock.c' when parsing SMB packets received in a client context. By sending specially crafted packets to an 'nmbd' server configured as a local or domain master browser, an attacker can leverage this issue to produce a heap-based buffer overflow and execute arbitrary code with system privileges.

Note that Nessus has not actually tried to exploit this issue, verify the remote 'nmbd' server's configuration, or determine if the fix has been applied.

Alin Rad Pop discovered that Samba contained a buffer overflow condition when processing certain responses received while acting as a client, leading to arbitrary code execution (CVE-2008-1105 ).

Fix CVE-2008-1105 A heap-based buffer overflow flaw has been found in the way Samba clients handle over-sized packets. If a client connected to a malicious Samba server, it was possible to execute arbitrary code as the Samba client user. The Samba server can also act as a client to perform some operations (print notify, domain member vs domain controler ...). This could result in the server executing the vulnerable client code, resulting in arbitrary code execution with the permissions of the Samba server.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-617-1 fixed vulnerabilities in Samba. The upstream patch introduced a regression where under certain circumstances accessing large files might cause the client to report an invalid packet length error. This update fixes the problem.

We apologize for the inconvenience.

Samba developers discovered that nmbd could be made to overrun a buffer during the processing of GETDC logon server requests. When samba is configured as a Primary or Backup Domain Controller, a remote attacker could send malicious logon requests and possibly cause a denial of service. (CVE-2007-4572)

Alin Rad Pop of Secunia Research discovered that Samba did not properly perform bounds checking when parsing SMB replies. A remote attacker could send crafted SMB packets and execute arbitrary code. (CVE-2008-1105).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated samba packages that fix a security issue and two bugs are now available for Red Hat Enterprise Linux 5.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Samba is a suite of programs used by machines to share files, printers, and other information.

A heap-based buffer overflow flaw was found in the way Samba clients handle over-sized packets. If a client connected to a malicious Samba server, it was possible to execute arbitrary code as the Samba client user. It was also possible for a remote user to send a specially crafted print request to a Samba server that could result in the server executing the vulnerable client code, resulting in arbitrary code execution with the permissions of the Samba server.
(CVE-2008-1105)

Red Hat would like to thank Alin Rad Pop of Secunia Research for responsibly disclosing this issue.

This update also addresses two issues which prevented Samba from joining certain Windows domains with tightened security policies, and prevented certain signed SMB content from working as expected :

* when some Windows(r) 2000-based domain controllers were set to use mandatory signing, Samba clients would drop the connection because of an error when generating signatures. This presented as a 'Server packet had invalid SMB signature' error to the Samba client. This update corrects the signature generation error.

* Samba servers using the 'net ads join' command to connect to a Windows Server(r) 2003-based domain would fail with 'failed to get schannel session key from server' and 'NT_STATUS_ACCESS_DENIED' errors. This update correctly binds to the NETLOGON share, allowing Samba servers to connect to the domain properly.

Users of Samba are advised to upgrade to these updated packages, which contain a backported patch to resolve these issues.

According to its model number and software version, the remote host is a Xerox WorkCentre device that reportedly allows a remote attacker to execute arbitrary code via specially crafted Service Message Block (SMB) responses due to vulnerabilities in the third-party code it uses to handle file and printer sharing services for SMB clients.

New samba packages are available for Slackware 10.0, 10.1, 10.2, 11.0, 12.0, 12.1, and -current to fix a security issue: 'Specifically crafted SMB responses can result in a heap overflow in the Samba client code. Because the server process, smbd, can itself act as a client during operations such as printer notification and domain authentication, this issue affects both Samba client and server installations.' This flaw affects Samba versions from 3.0.0 through 3.0.29.

The remote host is affected by the vulnerability described in GLSA-200805-23 (Samba: Heap-based buffer overflow)

    Alin Rad Pop (Secunia Research) reported a vulnerability in Samba     within the receive_smb_raw() function in the file lib/util_sock.c when     parsing SMB packets, possibly leading to a heap-based buffer overflow     via an overly large SMB packet.
  Impact :

    A remote attacker could possibly exploit this vulnerability by enticing     a user to connect to a malicious server or by sending specially crafted     packets to an nmbd server configured as a local or domain master     browser, resulting in the execution of arbitrary code.
  Workaround :

    There is no known workaround at this time.

Samba developers discovered that nmbd could be made to overrun a buffer during the processing of GETDC logon server requests. When samba is configured as a Primary or Backup Domain Controller, a remote attacker could send malicious logon requests and possibly cause a denial of service. (CVE-2007-4572)

Alin Rad Pop of Secunia Research discovered that Samba did not properly perform bounds checking when parsing SMB replies. A remote attacker could send crafted SMB packets and execute arbitrary code.
(CVE-2008-1105).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A heap-based buffer overflow flaw was found in the way Samba clients handle over-sized packets. If a client connected to a malicious Samba server, it was possible to execute arbitrary code as the Samba client user. It was also possible for a remote user to send a specially crafted print request to a Samba server that could result in the server executing the vulnerable client code, resulting in arbitrary code execution with the permissions of the Samba server.
(CVE-2008-1105)

A heap-based buffer overflow flaw was found in the way Samba clients handle over-sized packets. If a client connected to a malicious Samba server, it was possible to execute arbitrary code as the Samba client user. It was also possible for a remote user to send a specially crafted print request to a Samba server that could result in the server executing the vulnerable client code, resulting in arbitrary code execution with the permissions of the Samba server.
(CVE-2008-1105)

This update also addresses two issues which prevented Samba from joining certain Windows domains with tightened security policies, and prevented certain signed SMB content from working as expected :

  - when some Windows&reg; 2000-based domain controllers     were set to use mandatory signing, Samba clients would     drop the connection because of an error when generating     signatures. This presented as a 'Server packet had     invalid SMB signature' error to the Samba client. This     update corrects the signature generation error.

  - Samba servers using the 'net ads join' command to     connect to a Windows Server&reg; 2003-based domain would     fail with 'failed to get schannel session key from     server' and 'NT_STATUS_ACCESS_DENIED' errors. This     update correctly binds to the NETLOGON share, allowing     Samba servers to connect to the domain properly.

The remote NewStart CGSL host, running version MAIN 6.02, has samba packages installed that are affected by multiple vulnerabilities:

  - Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow     remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum     (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount     (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2     (lsa_io_trans_names). (CVE-2007-2446)

  - The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute     arbitrary commands via shell metacharacters involving the (1) SamrChangePassword function, when the     username map script smb.conf option is enabled, and allows remote authenticated users to execute     commands via shell metacharacters involving other MS-RPC functions in the (2) remote printer and (3) file     share management. (CVE-2007-2447)

  - Heap-based buffer overflow in the receive_smb_raw function in util/sock.c in Samba 3.0.0 through 3.0.29     allows remote attackers to execute arbitrary code via a crafted SMB response. (CVE-2008-1105)

  - Samba 3.4 before 3.4.2, 3.3 before 3.3.8, 3.2 before 3.2.15, and 3.0.12 through 3.0.36, as used in the SMB     subsystem in Apple Mac OS X 10.5.8 when Windows File Sharing is enabled, Fedora 11, and other operating     systems, does not properly handle errors in resolving pathnames, which allows remote authenticated users     to bypass intended sharing restrictions, and read, create, or modify files, in certain circumstances     involving user accounts that lack home directories. (CVE-2009-2813)

  - smbd in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8, and 3.4 before 3.4.2 allows remote     authenticated users to cause a denial of service (infinite loop) via an unanticipated oplock break     notification reply packet. (CVE-2009-2906)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated samba packages that fix a security issue and a bug are now available for Red Hat Enterprise Linux 2.1, Red Hat Enterprise Linux 3, and Red Hat Enterprise Linux 4.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Samba is a suite of programs used by machines to share files, printers, and other information.

A heap-based buffer overflow flaw was found in the way Samba clients handle over-sized packets. If a client connected to a malicious Samba server, it was possible to execute arbitrary code as the Samba client user. It was also possible for a remote user to send a specially crafted print request to a Samba server that could result in the server executing the vulnerable client code, resulting in arbitrary code execution with the permissions of the Samba server.
(CVE-2008-1105)

Red Hat would like to thank Alin Rad Pop of Secunia Research for responsibly disclosing this issue.

Users of Samba are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2008-0290 advisory.

    - Security fix for CVE-2008-1105
    - resolves: CVE-2008-1105

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Samba has been updated to fix a security problem :

CVE-2008-1105: Secunia research discovered vulnerability in Samba, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to a boundary error within the 'receive_smb_raw()' function in lib/util_sock.c when parsing SMB packets. This can be exploited to cause a heap-based buffer overflow via an overly large SMB packet received in a client context.

I   Service Console rpm updates

 a.  Security Update to Service Console Kernel

   This fix upgrades service console kernel version to 2.4.21-57.EL.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2007-5001, CVE-2007-6151, CVE-2007-6206,    CVE-2008-0007, CVE-2008-1367, CVE-2008-1375, CVE-2006-4814, and    CVE-2008-1669 to the security issues fixed in kernel-2.4.21-57.EL.

 b.  Samba Security Update

   This fix upgrades the service console rpm samba to version    3.0.9-1.3E.15vmw

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2008-1105 to this issue.

ID	名稱	產品	系列	已發布	已更新	嚴重性
32476	Samba < 3.0.30 receive_smb_raw Function Remote Buffer Overflow	Nessus	Misc.	2008/5/29	2018/11/15	high
32482	Debian DSA-1590-1 : samba - buffer overflow	Nessus	Debian Local Security Checks	2008/6/2	2021/1/4	high
32483	Fedora 8 : samba-3.0.30-0.fc8 (2008-4679)	Nessus	Fedora Local Security Checks	2008/6/2	2021/1/11	high
33388	Ubuntu 6.06 LTS / 7.04 / 7.10 / 8.04 LTS : samba regression (USN-617-2)	Nessus	Ubuntu Local Security Checks	2008/7/2	2021/1/19	high
43686	CentOS 5 : samba (CESA-2008:0290)	Nessus	CentOS Local Security Checks	2010/1/6	2021/1/4	high
34244	Xerox WorkCentre Samba Overflow (XRX08-009)	Nessus	Misc.	2008/9/19	2018/11/15	high
32455	Slackware 10.0 / 10.1 / 10.2 / 11.0 / 12.0 / 12.1 / current : samba (SSA:2008-149-01)	Nessus	Slackware Local Security Checks	2008/5/29	2021/1/14	high
32491	GLSA-200805-23 : Samba: Heap-based buffer overflow	Nessus	Gentoo Local Security Checks	2008/6/2	2021/1/6	high
33217	Ubuntu 6.06 LTS / 7.04 / 7.10 / 8.04 LTS : samba vulnerabilities (USN-617-1)	Nessus	Ubuntu Local Security Checks	2008/6/18	2021/1/19	high
60412	Scientific Linux Security Update : samba on SL3.x, SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high
60413	Scientific Linux Security Update : samba on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high
206855	NewStart CGSL MAIN 6.02 : samba Multiple Vulnerabilities (NS-SA-2024-0054)	Nessus	NewStart CGSL Local Security Checks	2024/9/10	2024/9/17	critical
32456	CentOS 3 / 4 : samba (CESA-2008:0288)	Nessus	CentOS Local Security Checks	2008/5/29	2021/1/4	high
32485	Fedora 9 : samba-3.2.0-1.rc1.14.fc9 (2008-4724)	Nessus	Fedora Local Security Checks	2008/6/2	2021/1/11	high
67694	Oracle Linux 5 : samba (ELSA-2008-0290)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2024/10/22	critical
33100	openSUSE 10 Security Update : cifs-mount (cifs-mount-5294)	Nessus	SuSE Local Security Checks	2008/6/5	2021/1/14	high
40380	VMSA-2008-0011 : Updated ESX service console packages for Samba and vmnix	Nessus	VMware ESX Local Security Checks	2009/7/27	2021/1/6	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high

high

high

high

critical

high

high

critical

high

high