AOH :: HP Unsorted S :: BX1023.HTM

send_mailslot() buffer overrun



Buffer overrun in send_mailslot()
Buffer overrun in send_mailslot()



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

============================================================ Subject:     Boundary failure in GETDC mailslot
==              processing can result in a buffer overrun
=== CVE ID#:     CVE-2007-6015
=== Versions:    Samba 3.0.0 - 3.0.27a (inclusive)
=== Summary:     Specifically crafted GETDC mailslot requests
==              can trigger a boundary error in the domain
==              controller GETDC mail slot support which
==              can be remotely exploited to execute arbitrary
==              code.
==========================================================
==========Description
==========
Secunia Research reported a vulnerability that allows for
the execution of arbitrary code in nmbd.  This defect is
only be exploited when the "domain logons" parameter has
been enabled in smb.conf.


=================Patch Availability
=================
A patch addressing this defect has been posted to

http://www.samba.org/samba/security/ 

Additionally, Samba 3.0.28 has been issued as a security
release to correct the defect.


=========Workaround
=========
Samba administrators may avoid this security issue by disabling
both the "domain logons" options in the server's smb.conf file.
Note that this will disable all domain controller features as
well.


======Credits
======
This vulnerability was reported to Samba developers by
Alin Rad Pop, Secunia Research.

The time line is as follows:

* Nov 22, 2007: Initial report to security@samba.org. 
* Nov 22, 2007: First response from Samba developers confirming
  the bug along with a proposed patch.
* Dec 10, 2007: Public security advisory made available.


=========================================================== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
=========================================================-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org 

iD8DBQFHXUQvIR7qMdg1EfYRArG0AJ9hSIu3s0AMtbgeaGDMTbSOXtA6ywCfSypz
T9GCNlOUVnZ2O25IOXQOzLk=cISn
-----END PGP SIGNATURE-----


The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.