Format string vulnerability in the afsacl.so VFS module in Samba 3.0.6 through 3.0.23d allows context-dependent attackers to execute arbitrary code via format string specifiers in a filename on an AFS file system, which is not properly handled during Windows ACL mapping.

A flaw was discovered in Samba's file opening code, which in certain situations could lead to an endless loop, resulting in a denial of service. (CVE-2007-0452)

A format string overflow was discovered in Samba's ACL handling on AFS shares. Remote users with access to an AFS share could create crafted filenames and execute arbitrary code with root privileges.
(CVE-2007-0454).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Samba Team reports :

NOTE: This security advisory only impacts Samba servers that share AFS file systems to CIFS clients and which have been explicitly instructed in smb.conf to load the afsacl.so VFS module.

The source defect results in the name of a file stored on disk being used as the format string in a call to snprintf(). This bug becomes exploitable only when a user is able to write to a share which utilizes Samba's afsacl.so library for setting Windows NT access control lists on files residing on an AFS file system.

According to its version number, the remote Samba server is affected by several flaws :

  - A denial of service issue occuring if an authenticated     attacker sends a large number of CIFS session requests     which will cause an infinite loop to occur in the smbd     daemon, thus utilizing CPU resources and denying access     to legitimate users ;

  - A remote format string vulnerability that could be     exploited by an attacker with write access to a remote     share by sending a malformed request to the remote     service (this issue only affects installations sharing     an AFS file system when the afsacl.so VFS module is     loaded)

  - A remote buffer overflow vulnerability affecting the NSS     lookup capability of the remote winbindd daemon

New samba packages are available for Slackware 10.0, 10.1, 10.2, and 11.0 to fix a denial-of-service security issue.

A logic error in the deferred open code for smbd may allow an authenticated user to exhaust resources such as memory and CPU on the server by opening multiple CIFS sessions, each of which will normally spawn a new smbd process, and sending each connection into an infinite loop. (CVE-2007-0452)

The name of a file on the server's share is used as the format string when setting an NT security descriptor through the afsacl.so VFS plugin. (CVE-2007-0454)

Updated packages have been patched to address these issues.

Several remote vulnerabilities have been discovered in samba, a free implementation of the SMB/CIFS protocol, which may lead to the execution of arbitrary code or denial of service. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-0452     It was discovered that incorrect handling of deferred     file open calls may lead to an infinite loop, which     results in denial of service.

  - CVE-2007-0454     'zybadawg333' discovered that the AFS ACL mapping VFS     plugin performs insecure format string handling, which     may lead to the execution of arbitrary code.

ID	Name	Product	Family	Severity
28011	Ubuntu 5.10 / 6.06 LTS / 6.10 : samba vulnerabilities (USN-419-1)	Nessus	Ubuntu Local Security Checks	high
24825	FreeBSD : samba -- format string bug in afsacl.so VFS plugin (57ae52f7-b9cc-11db-bf0f-0013720b182d)	Nessus	FreeBSD Local Security Checks	high
24685	Samba < 3.0.24 Multiple Flaws	Nessus	Misc.	high
24668	Slackware 10.0 / 10.1 / 10.2 / 11.0 : samba (SSA:2007-038-01)	Nessus	Slackware Local Security Checks	high
24647	Mandrake Linux Security Advisory : samba (MDKSA-2007:034)	Nessus	Mandriva Local Security Checks	high
24296	Debian DSA-1257-1 : samba - several vulnerabilities	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2007-0454

critical

Tenable Plugins

high

high

high

high

high

high