The process_logon_packet function in the nmbd server for Samba 3.0.6 and earlier, when domain logons are enabled, allows remote attackers to cause a denial of service via a SAM_UAS_CHANGE request with a length value that is larger than the number of structures that are provided.

According to its banner, the version of Samba is 3.0.x earlier than 3.0.7.  It is, therefore, affected by multiple vulnerabilities :

 - A flaw exists that may allow a remote denial of service.  The issue is triggered when an attacker sends specially crafted packets to the smbd daemon during the ASN.1 parsing routine causing many processes to spawn resulting in a loss of availability for the platform. (CVE-2004-0807)
 - A flaw exists that may allow a remote denial of service.  The issue is triggered when an attacker sends a malformed UDP packet and will result in loss of availability for Samba's nmbd daemon.  The 'process_logon_packet' function does not properly validate that the packet is appropriately sized to contain the number of structures it claims, when processing a 'SAM_UAS_CHANGE' request.  If the packet claims a large number of structures and a smaller number are contained in the packet, nmbd will reference memory outside of the packet, possibly causing the daemon to crash. (CVE-2004-0808)

Code found in nmbd and smbd may allow a remote attacker to effectively crash the nmbd server or use the smbd server to exhaust the system memory.

New samba packages are available for Slackware 10.0 and -current.
These fix two denial of service vulnerabilities reported by iDEFENSE.
Slackware -current has been upgraded to samba-3.0.7, while the samba-3.0.5 included with Slackware 10.0 has been patched to fix these issues. Sites running Samba 3.x should upgrade to the new package.
Versions of Samba before 3.0.x are not affected by these flaws.

Updated samba packages that fix two denial of service vulnerabilities are now available.

[Updated 23rd September 2004] Packages have been updated to include the ppc64 packages which were left out of the initial errata.

Samba provides file and printer sharing services to SMB/CIFS clients.

The Samba team has discovered a denial of service bug in the smbd daemon. A defect in smbd's ASN.1 parsing allows an attacker to send a specially crafted packet during the authentication request which will send the newly spawned smbd process into an infinite loop. Given enough of these packets, it is possible to exhaust the available memory on the server. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0807 to this issue.

Additionally the Samba team has also discovered a denial of service bug in the nmbd daemon. It is possible that an attacker could send a specially crafted UDP packet which could allow the attacker to anonymously crash nmbd. This issue only affects nmbd daemons which are configured to process domain logons. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0808 to this issue.

Users of Samba should upgrade to these updated packages, which contain an upgrade to Samba-3.0.7, which is not vulnerable to these issues.

Two vulnerabilities were discovered in samba 3.0.x; the first is a defect in smbd's ASN.1 parsing that allows an attacker to send a specially crafted packet during the authentication request which will send the newly spawned smbd process into an infinite loop. As a result, it is possible to use up all available memory on the server.

The second vulnerability is in nmbd's processing of mailslot packets which could allow an attacker to anonymously crash nmbd.

The provided packages are patched to protect against these two vulnerabilities.

The remote Samba server, according to its version number, is vulnerable to a denial of service.

There is a bug in the remote smbd ASN.1 parsing that could allow an attacker to cause a denial of service attack against the remote host by sending a specially crafted ASN.1 packet during the authentication request that could make the newly-spawned smbd process run into an infinite loop. By establishing multiple connections and sending such packets, an attacker could consume all the CPU and memory of the remote host, thus crashing it remotely.

Another bug could allow an attacker to crash the remote nmbd process by sending a malformed NetBIOS packet.

The remote host is affected by the vulnerability described in GLSA-200409-16 (Samba: Denial of Service vulnerabilities)

    There is a defect in smbd's ASN.1 parsing. A bad packet received during the     authentication request could throw newly-spawned smbd processes into an     infinite loop (CAN-2004-0807). Another defect was found in nmbd's     processing of mailslot packets, where a bad NetBIOS request could crash the     nmbd process (CAN-2004-0808).
  Impact :

    A remote attacker could send specially crafted packets to trigger both     defects. The ASN.1 parsing issue can be exploited to exhaust all available     memory on the Samba host, potentially denying all service to that server.
    The nmbd issue can be exploited to crash the nmbd process, resulting in a     Denial of Service condition on the Samba server.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
9341	Samba 3.0.x < 3.0.7 Multiple DoS	Nessus Network Monitor	Samba	medium
37486	FreeBSD : samba3 DoS attack (a711de5c-05fa-11d9-a9b2-00061bc2ad93)	Nessus	FreeBSD Local Security Checks	medium
18757	Slackware 10.0 / current : samba DoS (SSA:2004-257-01)	Nessus	Slackware Local Security Checks	medium
14801	RHEL 3 : samba (RHSA-2004:467)	Nessus	Red Hat Local Security Checks	medium
14723	Mandrake Linux Security Advisory : samba (MDKSA-2004:092)	Nessus	Mandriva Local Security Checks	medium
14711	Samba < 3.0.7 Multiple Remote DoS	Nessus	Denial of Service	medium
14710	GLSA-200409-16 : Samba: Denial of Service vulnerabilities	Nessus	Gentoo Local Security Checks	medium

Detections

Analytics

CVE-2004-0808

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium