OSVDB ID: 4469

Title: Samba trans2.c call_trans2open() Function Overflow

Info

Disclosure
Apr 07, 2003

Discovery
Apr 03, 2003

Dates

Exploit
Apr 08, 2003

Solution
Unknown

Description

 Samba contains a flaw that may allow a remote attacke to execute arbitrary code. The issue is due to a flaw in trans2.c in which the call_trans2open() function user input is not properly sanitized. If an attacker supplied an overly long string to the pname variable, they may be able to overflow the buffer and execute arbitrary code with the privileges of the server.

Classification

 Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Solution: Upgrade
Exploit: Exploit Public, Exploit Commercial
Disclosure: OSVDB Verified

Solution

 Upgrade to Samba version 2.2.8a, Samba-TNG 0.3.2, or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

Samba Project

Samba

 2.2.5
2.2.6
2.2.7
2.2.8
2.0.10
2.0.9
2.0.8
2.0.7
2.0.6
2.0.5a
2.0.5
2.0.4b
2.0.4a
2.0.4
2.0.3
2.0.2
2.0.1
2.0.0

Samba-TNG

 0.3.1

References

Credit
  • SECOPS team - labsdigitaldefense.net - Digital Defense Inc.


Direct URL: http://osvdb.org/4469