The smdb daemon (smbd/service.c) in Samba 3.0.1 through 3.0.22 allows remote attackers to cause a denial of service (memory consumption) via a large number of share connection requests.

According to its version number, the version of Samba running on the remote host has a security bypass vulnerability.  Access restrictions can be bypassed due to a read of uninitialized data in smbd.  This could allow a user to modify an access control list (ACL), even when they should be denied permission.

Note the 'dos filemode' parameter must be set to 'yes' in smb.conf in order for an attack to be successful (the default setting is 'no').

Also note versions 3.2.0 - 3.2.12 of smbclient are affected by a format string vulnerability, though Nessus has not checked for this.

- Fix pam config file parsing in pam_winbind; bso [#3916].

  - Prevent potential crash in winbindd's credential cache     handling; [#184450].

  - Fix memory exhaustion DoS; CVE-2006-3403; [#190468].

  - Fix the munlock call, samba.org svn rev r16755 from     Volker.

  - Change the kerberos principal for LDAP authentication to     netbios-name$@realm from host/name@realm; [#184450].

  - Ensure to link all required libraries to libnss_wins;
    [#184306].

  - Change log level of debug message to avaoid flodded nmbd     log; [#157623].

  - Add 'usershare allow guests = Yes' to the default     config; [#144787].

  - Fix syntax error in configure script.

The Samba security team reported a Denial of Service vulnerability in the handling of information about active connections. In certain circumstances an attacker could continually increase the memory usage of the smbd process by issuing a large number of share connection requests. By draining all available memory, this could be exploited to render the remote Samba server unusable.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Prevent potential crash in winbindd's credential cache     handling; [#184450].

  - Fix memory exhaustion DoS; CVE-2006-3403; [#190468].

  - Fix the munlock call, samba.org svn rev r16755 from     Volker.

  - Change the kerberos principal for LDAP authentication to     netbios-name$@realm from host/name@realm; [#184450].

  - Ensure to link all required libraries to libnss_wins;
    [#184306].

  - Change log level of debug message to avaoid flodded nmbd     log; [#157623].

  - Add 'usershare allow guests = Yes' to the default     config; [#144787].

  - Add CHANGEPW kpasswd fallback to TCP; [#184945].

  - Honour 'sn' attribute for eDir; [#176799].

  - Adapt smbclient fix to smbtree to enable long share     names; [#175999].

  - Make smbclient -L use RPC to list shares, fall back to     RAP; [#171311].

  - Re-add in-forest domain trusts; [bso #3823].

  - Remove SO_SNDBUF and SO_RCVBUF from socket options     example; [#165723].

  - Add wbinfo --own-domain; [#167344].

  - Fix usability of pam_winbind on a Samba PDC; [bso     #3800].

  - Remove intrusive affinity patches for winbindd.

  - Merge Volker's winbindd crash fix for half-opened     connections in winbindd_cm.c (sessionsetup succeeded but     tconX failed).

  - Optimize lookup of user's group memberships via     ExtendedDn LDAP control; [#168100].

  - Restart winbind if the hostname is modified by the DHCP     client; [#169260].

  - Prevent passwords beeing swapped to disc; [#174834].

  - Remove length limit from winbind cache cleanup function;
    [#175737].

  - Fix NDS_ldapsam memory leak.

  - Only add password to linked list when necessary.

  - Don't try cached credentials when changing passwords.

  - Cleanup winbind linked list of credential caches.

  - Use the index objectCategory attribute in AD LDAP     requests.

  - Adjust AD time difference when validating tickets.

  - Add password change warning for passwords beeing too     young.

  - Remove experimental Heimdal KCM support.

  - Added 'usershare allow guests' global parameter;
    [#144787].

  - Return domain name in samrquerydominfo 5; [#172756].

  - Fix unauthorized access when logging in with     pam_winbind; [#156385].

  - Don't ever set O_SYNC on open unless 'strict sync =     yes'; [#165431].

  - Correct fix to exit from 'net' with an inproper     configuration; [#163227], [#182749].

Gerald Carter discovered that the smbd daemon from Samba, a free implementation of the SMB/CIFS protocol, imposes insufficient limits in the code to handle shared connections, which can be exploited to exhaust system memory by sending maliciously crafted requests, leading to denial of service.

Updated samba packages that fix a denial of service vulnerability are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Samba provides file and printer sharing services to SMB/CIFS clients.

A denial of service bug was found in the way the smbd daemon tracks active connections to shares. It was possible for a remote attacker to cause the smbd daemon to consume a large amount of system memory by sending carefully crafted smb requests. (CVE-2006-3403)

Users of Samba are advised to upgrade to these packages, which contain a backported patch to correct this issue.

The remote host is affected by the vulnerability described in GLSA-200607-10 (Samba: Denial of Service vulnerability)

    During an internal audit the Samba team discovered that a flaw in the     way Samba stores share connection requests could lead to a Denial of     Service.
  Impact :

    By sending a large amount of share connection requests to a vulnerable     Samba server, an attacker could cause a Denial of Service due to memory     consumption.
  Workaround :

    There is no known workaround at this time.

New Samba packages are available for Slackware 10.0, 10.1, 10.2, and
-current to fix a security related (but in my own and also the Samba's team member who made their WHATSNEW.txt entry, 'minor') denial of service issue.

The remote Samba server, according to its version number, may be vulnerable to a remote attack.  An attacker can cause the Samba smbd service to fail by opening a large number of connections.  Successful exploitation leads to a loss of availability. 

A vulnerability in samba 3.0.x was discovered where an attacker could cause a single smbd process to bloat, exhausting memory on the system.
This bug is caused by continually increasing the size of an array which maintains state information about the number of active share connections.

Updated packages have been patched to correct this issue.

The Samba Team reports :

The smbd daemon maintains internal data structures used track active connections to file and printer shares. In certain circumstances an attacker may be able to continually increase the memory usage of an smbd process by issuing a large number of share connection requests.
This defect affects all Samba configurations.

ID	Name	Product	Family	Severity
39502	Samba < 3.0.35 / 3.2.13 / 3.3.6 Multiple Vulnerabilities	Nessus	Misc.	low
29574	SuSE 10 Security Update : Samba (ZYPP Patch Number 1961)	Nessus	SuSE Local Security Checks	medium
27890	Ubuntu 5.04 / 5.10 / 6.06 LTS : samba vulnerability (USN-314-1)	Nessus	Ubuntu Local Security Checks	medium
27426	openSUSE 10 Security Update : samba (samba-1830)	Nessus	SuSE Local Security Checks	medium
22652	Debian DSA-1110-1 : samba - missing input sanitising	Nessus	Debian Local Security Checks	medium
22112	RHEL 2.1 / 3 / 4 : samba (RHSA-2006:0591)	Nessus	Red Hat Local Security Checks	medium
22108	GLSA-200607-10 : Samba: Denial of Service vulnerability	Nessus	Gentoo Local Security Checks	medium
22104	CentOS 3 / 4 : samba (CESA-2006:0591)	Nessus	CentOS Local Security Checks	medium
22050	Slackware 10.0 / 10.1 / 10.2 / current : Samba DoS (SSA:2006-195-01)	Nessus	Slackware Local Security Checks	medium
3682	Samba < 3.0.23 smdb Share Remote DoS	Nessus Network Monitor	Samba	medium
22020	Mandrake Linux Security Advisory : samba (MDKSA-2006:120)	Nessus	Mandriva Local Security Checks	medium
22018	FreeBSD : samba -- memory exhaustion DoS in smbd (b168ddea-105a-11db-ac96-000c6ec775d9)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2006-3403

high

Tenable Plugins

low

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium