The code for writing reg files in Samba before 2.2.8 allows local users to overwrite arbitrary files via a race condition involving chown.

Sebastian Krahmer of the SuSE security audit team found two problems in samba, a popular SMB/CIFS implementation. The problems are :

  - a buffer overflow in the SMB/CIFS packet fragment     re-assembly code used by smbd. Since smbd runs as root     an attacker can use this to gain root access to a     machine running smbd.
  - the code to write reg files was vulnerable for a chown     race which made it possible for a local user to     overwrite system files

Both problems have been fixed in upstream version 2.2.8, and version 2.2.3a-12.1 of package for Debian GNU/Linux 3.0/woody.

The remote Samba-TNG server is vulnerable to multiple flaws that may let an attacker gain a root shell on this host.  As the version number did not change with the update, this alert might be a false positive 

The remote Samba server is vulnerable to a remote buffer overflow when receiving specially crafted SMB/CIFS packets. To exploit this flaw, an attacker would need to be able to access at least one share and send a specially formated packet which would execute arbitrary code on the remote host.

The SuSE security team, during an audit of the Samba source code, found a flaw in the main smbd code which could allow an external attacker to remotely and anonymously gain root privilege on a system running the Samba server. This flaw exists in all version of Samba 2.x up to and including 2.2.7a. The Samba team announced 2.2.8 today, however these updated packages include a patch that corrects this problem.

MandrakeSoft urges all users to upgrade immediately. If you are unable to apply the updated packages (perhaps due to unavailability on your preferred mirror), the following steps can be taken to protect an unpatched system:

The 'hosts allow' and 'hosts deny' options in the smb.conf file can be used to allow access to your Samba server by only selected hosts;
for example:

<pre> hosts allow = 127.0.0.1 192.168.2.0/24 192.168.3.0/24 hosts deny = 0.0.0.0/0 </pre>

This will disallow all connections from machines that are not the localhost or in the 192.168.2 and 192.168.3 private networks.
Alternatively, you can tell Samba to listen to only specific network interfaces by using the 'interfaces' and 'bind interfaces only' options:

<pre> interfaces = eth1 lo bind interfaces only = yes </pre>

Obviously, use the internal interface for your network and not an external interface connected to the internet. You may also choose to firewall off some UDP and TCP ports in addition to the previously mentioned suggestions by blocking external access to ports 137 and 138 (UDP) and ports 139 and 445 (TCP).

These steps should only be used as a temporary preventative measure and all users should upgrade as quickly as possible.

Thanks to Sebastian Krahmer and the SuSE security team for performing the audit, Jeremy Allison for providing the fix, and Andrew Tridgell for providing advice on how to protect an unpatched Samba system.

Updated Samba packages are now available to fix security vulnerabilities found during a code audit.

Samba is a suite of utilities which provides file and printer sharing services to SMB/CIFS clients.

Sebastian Krahmer discovered a security vulnerability present in unpatched versions of Samba prior to 2.2.8. An anonymous user could use the vulnerability to gain root access on the target machine.

Additionally, a race condition could allow an attacker to overwrite critical system files.

All users of Samba are advised to update to the erratum packages which contain patches to correct these vulnerabilities.

These packages contain the security fixes backported to the Samba 2.2.7 codebase.

The remote Samba server, according to its version number, is vulnerable to a remote buffer overflow when receiving specially crafted SMB fragment packets.

An attacker needs to be able to access at least one share to exploit this flaw.

In addition, it is reported that Samba contains a flaw related to the handling of .reg files that may allow a local user to overwrite arbitrary file.

ID	Name	Product	Family	Severity
15099	Debian DSA-262-1 : samba - remote exploit	Nessus	Debian Local Security Checks	critical
1341	Samba-TNG < 0.3.1 Multiple Vulnerabilities (deprecated)	Nessus Network Monitor	Samba	high
1339	Samba < 2.2.8 Fragment Reassembly Overflow / Arbitrary File Overwrite	Nessus Network Monitor	Samba	high
14016	Mandrake Linux Security Advisory : samba (MDKSA-2003:032)	Nessus	Mandriva Local Security Checks	critical
12379	RHEL 2.1 : samba (RHSA-2003:096)	Nessus	Red Hat Local Security Checks	critical
11398	Samba < 2.2.8 Multiple Vulnerabilities	Nessus	Gain a shell remotely	critical

Detections

Analytics

CVE-2003-0086

medium

Tenable Plugins

critical

high

high

critical

critical

critical