PT-2003-1115 · Samba Team+2 · Samba-Swat+5
Sebastian Krahmer
·
Published
2003-03-18
·
Updated
2021-03-25
·
CVE-2003-0085
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Samba versions prior to 2.2.8
Samba-TNG versions prior to 0.3.1
samba-swat versions 2.0.10 and 2.2.7
samba-client versions 2.0.10 and 2.2.7
samba-common versions 2.0.10 and 2.2.7
Description
The issue is related to multiple vulnerabilities in the Samba package, which can lead to a disruption of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely. A buffer overflow exists in the SMB/CIFS packet fragment re-assembly code for the SMB daemon, allowing remote attackers to execute arbitrary code. The service fails to check a field length inside of the request before using this length in a memcpy() operation, resulting in a buffer overflow. With a specially crafted request, an attacker can cause arbitrary code to be executed with super-user privileges.
Recommendations
For Samba versions prior to 2.2.8, update to version 2.2.8 or later.
For Samba-TNG versions prior to 0.3.1, update to version 0.3.1 or later.
For samba-swat, samba-client, and samba-common versions 2.0.10 and 2.2.7, update to a version that is not affected by these vulnerabilities.
As a temporary workaround, consider restricting access to the SMB daemon to minimize the risk of exploitation.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Samba
Samba-Tng
Samba-Client
Samba-Common
Samba-Swat