Two vulnerabilities were discovered in samba 3.0.x; the first is a defect in smbd's ASN.1 parsing that allows an attacker to send a specially crafted packet during the authentication request which will send the newly spawned smbd process into an infinite loop. As a result, it is possible to use up all available memory on the server.

The second vulnerability is in nmbd's processing of mailslot packets which could allow an attacker to anonymously crash nmbd.

The provided packages are patched to protect against these two vulnerabilities.

リモートSambaサーバーは、そのバージョン番号によると、サービス拒否に脆弱です。

リモートsmbd ASN.1解析にバグがあり、攻撃者が認証リクエスト中に特別に細工したASN.1パケットを送信することで、リモートホストに対してサービス拒否攻撃を引き起こし、新たに生成されたsmbdプロセスを無限ループに陥らせる可能性があります。複数の接続を確立してそのようなパケットを送信すると、攻撃者がリモートホストのCPUとメモリをすべて消費し、リモートでクラッシュさせる可能性があります。

別のバグでは、攻撃者が無効な形式のNetBIOSパケットを送信することで、リモートnmbdプロセスをクラッシュさせる可能性があります。

根据其版本号，远程 Samba 服务器容易受到拒绝服务的影响。

远程 smbd ASN.1 解析中存在一个错误，该错误允许攻击者通过在身份验证请求期间发送特别构建的 ASN.1 数据包来针对远程主机发起拒绝服务攻击，这可使新生成的 smbd 进程陷入无限循环。通过建立多个连接并发送此类数据包，攻击者可以消耗远程主机的所有 CPU 和内存，从而远程导致其崩溃。

另一错误允许攻击者通过发送畸形 NetBIOS 数据包导致远程 nmbd 进程崩溃。

根據遠端 Samba 伺服器的版本號碼，其容易遭受拒絕服務攻擊。

遠端 smbd ASN.1 剖析中存在錯誤，允許攻擊者在驗證要求期間傳送特製的 ASN.1 封包，使新衍生的 smbd 處理程序進入無限迴圈，進而對遠端主機發動拒絕服務攻擊。攻擊者可藉由建立多個連線並傳送此類封包，來耗盡遠端主機的所有 CPU 和記憶體，進而在遠端造成主機當機。

另一個錯誤可允許攻擊者傳送格式錯誤的 NetBIOS 封包，從而損毀遠端 nmbd 處理程序。

The remote host is affected by the vulnerability described in GLSA-200409-16 (Samba: Denial of Service vulnerabilities)

    There is a defect in smbd's ASN.1 parsing. A bad packet received during the     authentication request could throw newly-spawned smbd processes into an     infinite loop (CAN-2004-0807). Another defect was found in nmbd's     processing of mailslot packets, where a bad NetBIOS request could crash the     nmbd process (CAN-2004-0808).
  Impact :

    A remote attacker could send specially crafted packets to trigger both     defects. The ASN.1 parsing issue can be exploited to exhaust all available     memory on the Samba host, potentially denying all service to that server.
    The nmbd issue can be exploited to crash the nmbd process, resulting in a     Denial of Service condition on the Samba server.
  Workaround :

    There is no known workaround at this time.

Code found in nmbd and smbd may allow a remote attacker to effectively crash the nmbd server or use the smbd server to exhaust the system memory.

The remote Samba server, according to its version number, is vulnerable to a denial of service.

There is a bug in the remote smbd ASN.1 parsing that could allow an attacker to cause a denial of service attack against the remote host by sending a specially crafted ASN.1 packet during the authentication request that could make the newly-spawned smbd process run into an infinite loop. By establishing multiple connections and sending such packets, an attacker could consume all the CPU and memory of the remote host, thus crashing it remotely.

Another bug could allow an attacker to crash the remote nmbd process by sending a malformed NetBIOS packet.

Updated samba packages that fix two denial of service vulnerabilities are now available.

[Updated 23rd September 2004] Packages have been updated to include the ppc64 packages which were left out of the initial errata.

Samba provides file and printer sharing services to SMB/CIFS clients.

The Samba team has discovered a denial of service bug in the smbd daemon. A defect in smbd's ASN.1 parsing allows an attacker to send a specially crafted packet during the authentication request which will send the newly spawned smbd process into an infinite loop. Given enough of these packets, it is possible to exhaust the available memory on the server. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0807 to this issue.

Additionally the Samba team has also discovered a denial of service bug in the nmbd daemon. It is possible that an attacker could send a specially crafted UDP packet which could allow the attacker to anonymously crash nmbd. This issue only affects nmbd daemons which are configured to process domain logons. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0808 to this issue.

Users of Samba should upgrade to these updated packages, which contain an upgrade to Samba-3.0.7, which is not vulnerable to these issues.

New samba packages are available for Slackware 10.0 and -current.
These fix two denial of service vulnerabilities reported by iDEFENSE.
Slackware -current has been upgraded to samba-3.0.7, while the samba-3.0.5 included with Slackware 10.0 has been patched to fix these issues. Sites running Samba 3.x should upgrade to the new package.
Versions of Samba before 3.0.x are not affected by these flaws.

According to its banner, the version of Samba is 3.0.x earlier than 3.0.7.  It is, therefore, affected by multiple vulnerabilities :

 - A flaw exists that may allow a remote denial of service.  The issue is triggered when an attacker sends specially crafted packets to the smbd daemon during the ASN.1 parsing routine causing many processes to spawn resulting in a loss of availability for the platform. (CVE-2004-0807)
 - A flaw exists that may allow a remote denial of service.  The issue is triggered when an attacker sends a malformed UDP packet and will result in loss of availability for Samba's nmbd daemon.  The 'process_logon_packet' function does not properly validate that the packet is appropriately sized to contain the number of structures it claims, when processing a 'SAM_UAS_CHANGE' request.  If the packet claims a large number of structures and a smaller number are contained in the packet, nmbd will reference memory outside of the packet, possibly causing the daemon to crash. (CVE-2004-0808)

ID	名稱	產品	系列	已發布	已更新	嚴重性
14723	Mandrake Linux Security Advisory : samba (MDKSA-2004:092)	Nessus	Mandriva Local Security Checks	2004/9/14	2021/1/6	medium
14711	Samba < 3.0.7 複数のリモートDoS	Nessus	Denial of Service	2004/9/13	2018/7/27	medium
14711	Samba < 3.0.7 多个远程 DoS	Nessus	Denial of Service	2004/9/13	2018/7/27	medium
14711	Samba < 3.0.7 多個遠端 DoS 弱點	Nessus	Denial of Service	2004/9/13	2018/7/27	medium
14710	GLSA-200409-16 : Samba: Denial of Service vulnerabilities	Nessus	Gentoo Local Security Checks	2004/9/13	2021/1/6	medium
37486	FreeBSD : samba3 DoS attack (a711de5c-05fa-11d9-a9b2-00061bc2ad93)	Nessus	FreeBSD Local Security Checks	2009/4/23	2021/1/6	medium
14711	Samba < 3.0.7 Multiple Remote DoS	Nessus	Denial of Service	2004/9/13	2018/7/27	medium
14801	RHEL 3 : samba (RHSA-2004:467)	Nessus	Red Hat Local Security Checks	2004/9/23	2021/1/14	medium
18757	Slackware 10.0 / current : samba DoS (SSA:2004-257-01)	Nessus	Slackware Local Security Checks	2005/7/13	2021/1/14	medium
9341	Samba 3.0.x < 3.0.7 Multiple DoS	Nessus Network Monitor	Samba	2016/6/9	2019/3/6	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium