PT-2010-1077 · Samba+3 · Samba+3
Andrew Bartlett
·
Published
2010-09-14
·
Updated
2024-06-15
·
CVE-2010-3069
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Samba versions prior to 3.5.5
Samba versions 3.0.9 through 3.5.4
Description
The issue is related to a stack-based buffer overflow in the sid parse and dom sid parse functions in Samba, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted Windows Security ID (SID) on a file share. This can lead to a violation of confidentiality, integrity, and availability of protected information. The exploitation of this issue can be carried out remotely.
Recommendations
For Samba versions 3.0.9 through 3.5.4, update to version 3.5.5 or later to resolve the issue.
For versions prior to 3.5.5, update to version 3.5.5 or later to resolve the issue.
As a temporary workaround, consider restricting access to the vulnerable functions sid parse and dom sid parse until a patch is available.
Exploit
Fix
DoS
Infinite Loop
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Hp-Ux
Red Hat
Samba
Suse