Buffer overflow in Samba

1) Buffer overflow

EUVDB-ID: #VU45287

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2011-0719

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

Samba 3.x before 3.3.15, 3.4.x before 3.4.12, and 3.5.x before 3.5.7 does not perform range checks for file descriptors before use of the FD_SET macro, which allows remote attackers to cause a denial of service (stack memory corruption, and infinite loop or daemon crash) by opening a large number of files, related to (1) Winbind or (2) smbd.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Samba: 3.0.0 - 3.5.6

CPE2.3

• cpe:2.3:a:samba:samba:3.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:samba:samba:3.0.1:*:*:*:*:*:*:*
• cpe:2.3:a:samba:samba:3.0.2:*:*:*:*:*:*:*
• cpe:2.3:a:samba:samba:3.0.2a:*:*:*:*:*:*:*
• cpe:2.3:a:samba:samba:3.0.3:*:*:*:*:*:*:*
• cpe:2.3:a:samba:samba:3.0.4:*:*:*:*:*:*:*
• cpe:2.3:a:samba:samba:3.0.5:*:*:*:*:*:*:*
• cpe:2.3:a:samba:samba:3.0.6:*:*:*:*:*:*:*
• cpe:2.3:a:samba:samba:3.0.7:*:*:*:*:*:*:*
• cpe:2.3:a:samba:samba:3.0.8:*:*:*:*:*:*:*

External links

https://lists.apple.com/archives/security-announce/2011//Jun/msg00000.html
https://lists.fedoraproject.org/pipermail/package-announce/2011-March/056229.html
https://lists.fedoraproject.org/pipermail/package-announce/2011-March/056241.html
https://marc.info/?l=bugtraq&m=130835366526620&w=2
https://samba.org/samba/security/CVE-2011-0719.html
https://secunia.com/advisories/43482
https://secunia.com/advisories/43503
https://secunia.com/advisories/43512
https://secunia.com/advisories/43517
https://secunia.com/advisories/43556
https://secunia.com/advisories/43557
https://secunia.com/advisories/43843
https://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.593629
https://support.apple.com/kb/HT4723
https://www.debian.org/security/2011/dsa-2175
https://www.mandriva.com/security/advisories?name=MDVSA-2011:038
https://www.redhat.com/support/errata/RHSA-2011-0305.html
https://www.redhat.com/support/errata/RHSA-2011-0306.html
https://www.samba.org/samba/history/samba-3.3.15.html
https://www.samba.org/samba/history/samba-3.4.12.html
https://www.samba.org/samba/history/samba-3.5.7.html
https://www.securityfocus.com/bid/46597
https://www.securitytracker.com/id?1025132
https://www.ubuntu.com/usn/USN-1075-1
https://www.vupen.com/english/advisories/2011/0517
https://www.vupen.com/english/advisories/2011/0518
https://www.vupen.com/english/advisories/2011/0519
https://www.vupen.com/english/advisories/2011/0520
https://www.vupen.com/english/advisories/2011/0522
https://www.vupen.com/english/advisories/2011/0541
https://www.vupen.com/english/advisories/2011/0702
https://bugzilla.redhat.com/show_bug.cgi?id=678328
https://exchange.xforce.ibmcloud.com/vulnerabilities/65724

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.