Buffer overflow in the call_trans2open function in trans2.c for Samba 2.2.x before 2.2.8a, 2.0.10 and earlier 2.0.x versions, and Samba-TNG before 0.3.2, allows remote attackers to execute arbitrary code.

The version of Samba running on the remote host is prior to 2.2.8a. It is, therefore, affected by a remote code execution vulnerability in the SMB/CIFS packet fragment re-assembly code in smbd.  An unauthenticated, remote attacker can exploit this to inject binary specific exploit code into smbd and gain root access on a Samba serving system.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Digital Defense, Inc. has alerted the Samba Team to a serious vulnerability in Samba, a LanManager-like file and printer server for Unix. This vulnerability can lead to an anonymous user gaining root access on a Samba serving system. An exploit for this problem is already circulating and in use.

Since the packages for potato are quite old it is likely that they contain more security-relevant bugs that we don't know of. You are therefore advised to upgrade your systems running Samba to woody soon.

Unofficial backported packages from the Samba maintainers for version 2.2.8 of Samba for woody are available at ~peloy and ~vorlon.

The remote Samba server is vulnerable to a buffer overflow when it processes the function trans2open().  An attacker may exploit it to gain a root shell on this host.

An exploitable buffer overflow was discovered in the Samba server that can lead to an anonymous remote root compromise. The Samba Team also discovered some potential overflows during an internal code audit which was done in response to the previously noted buffer overflow problem.

All versions of Samba prior to 2.2.8a are vulnerable. The provided updates contain a patch from the Samba Team to correct the issue.

An exploit is known to exist and all Mandrake Linux users are encouraged to upgrade immediately.

The remote host is missing a security patch for samba. It is, therefore, affected by a buffer overflow condition in the call_trans2open() function within file trans2.c due to improper sanitization of user-supplied input. An unauthenticated, remote attacker can exploit this, via an overly long string passed to the pname variable, to execute arbitrary code with the privileges of the server.

Updated Samba packages that fix a security vulnerability are now available.

Samba is a suite of utilities which provides file and printer sharing services to SMB/CIFS clients.

A security vulnerability has been found in versions of Samba up to and including 2.2.8. An anonymous user could exploit the vulnerability to gain root access on the target machine. Note that this is a different vulnerability than the one fixed by RHSA-2003:096.

An exploit for this vulnerability is publicly available.

All users of Samba are advised to update to the packages listed in this erratum, which contain a backported patch correcting this vulnerability.

The remote Samba server is vulnerable to a buffer overflow when it calls the function trans2open(). An attacker may exploit this flaw to gain a root shell on this host.

In addition, it is reported that this version of Samba is vulnerable to additional overflows, although Nessus has not checked for them.

ID	Name	Product	Family	Severity
122056	Samba < 2.2.8a Remote Code Execution Vulnerability	Nessus	Misc.	high
15117	Debian DSA-280-1 : samba - buffer overflow	Nessus	Debian Local Security Checks	critical
1342	Samba < 2.2.8a 'trans2.c trans2open()' Function Overflow	Nessus Network Monitor	Samba	critical
14028	Mandrake Linux Security Advisory : samba (MDKSA-2003:044)	Nessus	Mandriva Local Security Checks	critical
13795	SUSE-SA:2003:025: samba	Nessus	SuSE Local Security Checks	critical
12387	RHEL 2.1 : samba (RHSA-2003:138)	Nessus	Red Hat Local Security Checks	critical
11523	Samba < 2.2.8a / 3.0.0 Multiple Remote Overflows	Nessus	Gain a shell remotely	critical

Detections

Analytics

CVE-2003-0201

critical

Tenable Plugins

high

critical

critical

critical

critical

critical

critical