Samba
Subject: Possible remote code execution
CVE ID#: CAN-2004-1154
Versions: Samba 2.x & 3.0.x <= 3.0.9
Summary: A potential integer overflow when unmarshalling specific
MS-RPC requests from clients could lead to heap corruption and
remote code execution.
Description
Remote exploitation of an integer overflow vulnerability in the
smbd daemon included in Samba 2.0.x, Samba 2.2.x, and Samba 3.0.x
prior to and including 3.0.9 could allow an attacker to cause
controllable heap corruption, leading to execution of arbitrary
commands with root privileges.
Successful remote exploitation allows an attacker to gain root
privileges on a vulnerable system. In order to exploit this
vulnerability an attacker must possess credentials that allow
access to a share on the Samba server. Unsuccessful exploitation
attempts will cause the process serving the request to crash with
signal 11, and may leave evidence of an attack in logs.
Patch Availability
A patch for Samba 3.0.9 (samba-3.0.9-CAN-2004-1154.patch/)
can be downloaded from
http://www.samba.org/samba/ftp/patches/security/
The patch has been signed with the “Samba Distribution
Verification Key” (ID F17F9772).
Protecting Unpatched Servers
The Samba Team always encourages users to run the latest stable
release as a defense against attacks. However, under certain
circumstances it may not be possible to immediately upgrade
important installations. In such cases, administrators should read
the “Server Security” documentation found at
http://www.samba.org/samba/docs/server_security.html.
Credits
This security issue was reported to Samba developers by iDEFENSE
Labs. The vulnerability was discovered by Greg MacManus, iDEFENSE
Labs.
Our Code, Our Bugs, Our Responsibility. The Samba Team
Gentoo Linux
Linux Security Advisory GLSA 200412-11
Severity: Normal
Title: Cscope: Insecure creation of temporary files
Date: December 16, 2004
Bugs: #71595
ID: 200412-11
Synopsis
Cscope is vulnerable to symlink attacks, potentially allowing a
local user to overwrite arbitrary files.
Background
Cscope is a developer utility used to browse and manage source
code.
Affected packages
Package / Vulnerable / Unaffected 1 dev-util/cscope < 15.5-r2 >= 15.5-r2
Description
Cscope creates temporary files in world-writable directories
with predictable names.
Impact
A local attacker could create symbolic links in the temporary
files directory, pointing to a valid file somewhere on the
filesystem. When Cscope is executed, this would result in the file
being overwritten with the rights of the user running the utility,
which could be the root user.
Workaround
There is no known workaround at this time.
Resolution
All Cscope users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-util/cscope-15.5-r2"
References
[ 1 ] CAN-2004-0996
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0996
[ 2 ] BugTraq Advisory
http://www.securityfocus.com/archive/1/381443
Availability
This GLSA and any updates to it are available for viewing at the
Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200412-11.xml
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or
alternatively, you may file a bug at http://bugs.gentoo.org.
License
Copyright 2004 Gentoo Foundation, Inc; referenced text belongs
to its owner(s).
The contents of this document are licensed under the Creative
Commons – Attribution / Share Alike license.