PT-2010-1077 · Samba+3 · Samba+3
Andrew Bartlett
·
Publicado
2010-09-14
·
Atualizado
2024-06-15
·
CVE-2010-3069
CVSS v2.0
7.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Samba versions prior to 3.5.5
Samba versions 3.0.9 through 3.5.4
Description
The issue is related to a stack-based buffer overflow in the sid parse and dom sid parse functions in Samba, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted Windows Security ID (SID) on a file share. This can lead to a violation of confidentiality, integrity, and availability of protected information. The exploitation of this issue can be carried out remotely.
Recommendations
For Samba versions 3.0.9 through 3.5.4, update to version 3.5.5 or later to resolve the issue.
For versions prior to 3.5.5, update to version 3.5.5 or later to resolve the issue.
As a temporary workaround, consider restricting access to the vulnerable functions sid parse and dom sid parse until a patch is available.
Exploit
Correção
DoS
Infinite Loop
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Hp-Ux
Red Hat
Samba
Suse