Stack-based buffer overflow in the reply_netbios_packet function in nmbd/nmbd_packets.c in nmbd in Samba 3.0.0 through 3.0.26a, when operating as a WINS server, allows remote attackers to execute arbitrary code via crafted WINS Name Registration requests followed by a WINS Name Query request.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2007-1017 advisory.

  - The Winbind nss_info extension (nsswitch/idmap_ad.c) in idmap_ad.so in Samba 3.0.25 through 3.0.25c, when     the winbind nss info option is set to rfc2307 or sfu, grants all local users the privileges of gid 0     when the (1) RFC2307 or (2) Services for UNIX (SFU) primary group attribute is not defined.
    (CVE-2007-4138)

  - Stack-based buffer overflow in nmbd in Samba 3.0.0 through 3.0.26a, when configured as a Primary or Backup     Domain controller, allows remote attackers to have an unknown impact via crafted GETDC mailslot requests,     related to handling of GETDC logon server requests. (CVE-2007-4572)

  - Stack-based buffer overflow in the reply_netbios_packet function in nmbd/nmbd_packets.c in nmbd in Samba     3.0.0 through 3.0.26a, when operating as a WINS server, allows remote attackers to execute arbitrary code     via crafted WINS Name Registration requests followed by a WINS Name Query request. (CVE-2007-5398)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2007:1016 :

Updated samba packages that fix several security issues are now available for Red Hat Enterprise Linux 4.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Samba is a suite of programs used by machines to share files, printers, and other information.

A buffer overflow flaw was found in the way Samba creates NetBIOS replies. If a Samba server is configured to run as a WINS server, a remote unauthenticated user could cause the Samba server to crash or execute arbitrary code. (CVE-2007-5398)

A heap-based buffer overflow flaw was found in the way Samba authenticates users. A remote unauthenticated user could trigger this flaw to cause the Samba server to crash. Careful analysis of this flaw has determined that arbitrary code execution is not possible, and under most circumstances will not result in a crash of the Samba server. (CVE-2007-4572)

A flaw was found in the way Samba assigned group IDs under certain conditions. If the 'winbind nss info' parameter in smb.conf is set to either 'sfu' or 'rfc2307', Samba users are incorrectly assigned the group ID of 0. (CVE-2007-4138)

Red Hat would like to thank Alin Rad Pop of Secunia Research, Rick King, and the Samba developers for responsibly disclosing these issues.

All Samba users are advised to upgrade to these updated packages, which contain a backported patch to correct these issues.

From Red Hat Security Advisory 2007:1013 :

Updated samba packages that fix several security issues are now available for Red Hat Enterprise Linux 2.1 and 3.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Samba is a suite of programs used by machines to share files, printers, and other information.

A buffer overflow flaw was found in the way Samba creates NetBIOS replies. If a Samba server is configured to run as a WINS server, a remote unauthenticated user could cause the Samba server to crash or execute arbitrary code. (CVE-2007-5398)

A heap-based buffer overflow flaw was found in the way Samba authenticates users. A remote unauthenticated user could trigger this flaw to cause the Samba server to crash. Careful analysis of this flaw has determined that arbitrary code execution is not possible, and under most circumstances will not result in a crash of the Samba server. (CVE-2007-4572)

Red Hat would like to thank Alin Rad Pop of Secunia Research, and the Samba developers for responsibly disclosing these issues.

Users of Samba are advised to ugprade to these updated packages, which contain backported patches to resolve these issues.

Updated samba packages that fix several security issues are now available for Red Hat Enterprise Linux 4.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Samba is a suite of programs used by machines to share files, printers, and other information.

A buffer overflow flaw was found in the way Samba creates NetBIOS replies. If a Samba server is configured to run as a WINS server, a remote unauthenticated user could cause the Samba server to crash or execute arbitrary code. (CVE-2007-5398)

A heap-based buffer overflow flaw was found in the way Samba authenticates users. A remote unauthenticated user could trigger this flaw to cause the Samba server to crash. Careful analysis of this flaw has determined that arbitrary code execution is not possible, and under most circumstances will not result in a crash of the Samba server. (CVE-2007-4572)

A flaw was found in the way Samba assigned group IDs under certain conditions. If the 'winbind nss info' parameter in smb.conf is set to either 'sfu' or 'rfc2307', Samba users are incorrectly assigned the group ID of 0. (CVE-2007-4138)

Red Hat would like to thank Alin Rad Pop of Secunia Research, Rick King, and the Samba developers for responsibly disclosing these issues.

All Samba users are advised to upgrade to these updated packages, which contain a backported patch to correct these issues.

Updated samba packages that fix a security issue are now available for Red Hat Enterprise Linux 4.5 Extended Update Support.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Samba is a suite of programs used by machines to share files, printers, and other information.

A buffer overflow flaw was found in the way Samba creates NetBIOS replies. If a Samba server is configured to run as a WINS server, a remote unauthenticated user could cause the Samba server to crash, or execute arbitrary code. (CVE-2007-5398)

Red Hat would like to thank Alin Rad Pop of Secunia Research for responsibly disclosing this issue.

Users of Samba should upgrade to these updated packages, which contain a backported patch to correct this issue.

A buffer overflow flaw was found in the way Samba creates NetBIOS replies. If a Samba server is configured to run as a WINS server, a remote unauthenticated user could cause the Samba server to crash or execute arbitrary code. (CVE-2007-5398)

A heap based buffer overflow flaw was found in the way Samba authenticates users. A remote unauthenticated user could trigger this flaw to cause the Samba server to crash. Careful analysis of this flaw has determined that arbitrary code execution is not possible, and under most circumstances will not result in a crash of the Samba server. (CVE-2007-4572)

A flaw was found in the way Samba assigned group IDs under certain conditions. If the 'winbind nss info' parameter in smb.conf is set to either 'sfu' or 'rfc2307', Samba users are incorrectly assigned the group ID of 0. (CVE-2007-4138)

I   Service Console package security updates

  a. OpenPegasus PAM Authentication Buffer Overflow

  Alexander Sotirov from VMware Security Research discovered a   buffer overflow vulnerability in the OpenPegasus Management server.
  This flaw could be exploited by a malicious remote user on the   service console network to gain root access to the service console.

  The Common Vulnerabilities and Exposures project (cve.mitre.org)   has assigned the name CVE-2007-5360 to this issue.

  b.   Updated Samba package

       An issue where attackers on the service console management        network can cause a stack-based buffer overflow in the        reply_netbios_packet function of nmbd in Samba. On systems        where Samba is being used as a WINS server, exploiting this        vulnerability can allow remote attackers to execute arbitrary        code via crafted WINS Name Registration requests followed by a        WINS Name Query request.

       An issue where attackers on the service console management        network can exploit a vulnerability that occurs when Samba is        configured as a Primary or Backup Domain controller. The        vulnerability allows remote attackers to have an unknown impact        via crafted GETDC mailslot requests, related to handling of        GETDC logon server requests.

       The Common Vulnerabilities and Exposures project (cve.mitre.org)        has assigned the names CVE-2007-5398 and CVE-2007-4572 to these        issues.

 Note: By default Samba is not configured as a WINS server or a domain        controller and ESX is not vulnerable unless the administrator        has changed the default configuration.

       This vulnerability can be exploited remotely only if the        attacker has access to the service console network.

       Security best practices provided by VMware recommend that the        service console be isolated from the VM network. Please see        http://www.vmware.com/resources/techresources/726 for more        information on VMware security best practices.

  c.   Updated util-linux package

       The patch addresses an issue where the mount and umount        utilities in util-linux call the setuid and setgid functions in        the wrong order and do not check the return values, which could        allow attackers to gain elevated privileges via helper        application such as mount.nfs.

       The Common Vulnerabilities and Exposures project (cve.mitre.org)        has assigned the name CVE-2007-5191 to this issue.

  d.   Updated Perl package

       The update addresses an issue where the regular expression        engine in Perl can be used to issue a specially crafted regular        expression that allows the attacker to run arbitrary code with        the permissions level of the current Perl user.

       The Common Vulnerabilities and Exposures project (cve.mitre.org)        has assigned the name CVE-2007-5116 to this issue.

  e.   Updated OpenSSL package

       A flaw in the SSL_get_shared_ciphers() function could allow an        attacker to cause a buffer overflow problem by sending ciphers        to applications that use the function.

       The Common Vulnerabilities and Exposures project (cve.mitre.org)        has assigned the names CVE-2007-3108, and CVE-2007-5135 to these        issues.

Updated samba packages that fix several security issues are now available for Red Hat Enterprise Linux 2.1 and 3.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Samba is a suite of programs used by machines to share files, printers, and other information.

A buffer overflow flaw was found in the way Samba creates NetBIOS replies. If a Samba server is configured to run as a WINS server, a remote unauthenticated user could cause the Samba server to crash or execute arbitrary code. (CVE-2007-5398)

A heap-based buffer overflow flaw was found in the way Samba authenticates users. A remote unauthenticated user could trigger this flaw to cause the Samba server to crash. Careful analysis of this flaw has determined that arbitrary code execution is not possible, and under most circumstances will not result in a crash of the Samba server. (CVE-2007-4572)

Red Hat would like to thank Alin Rad Pop of Secunia Research, and the Samba developers for responsibly disclosing these issues.

Users of Samba are advised to ugprade to these updated packages, which contain backported patches to resolve these issues.

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have Security Update 2007-009 applied. 

This update contains several security fixes for a large number of programs.

This update fixes two buffer overflows in nmbd (CVE-2007-4572 / CVE-2007-5398). Remote attackers could potentially exploit them to execute arbitrary code.

The updated packages additionally contain fixes for numerous other defects. Please refer to the package changelog for details.

This update fixes two buffer overflows in nmbd (CVE-2007-4572, CVE-2007-5398). Remote attackers could potentially exploit them to execute arbitrary code.

The updated packages additionally contain fixes for numerous other defects. Please refer to the package changelog for details.

The remote host is affected by the vulnerability described in GLSA-200711-29 (Samba: Execution of arbitrary code)

    Two vulnerabilities have been reported in nmbd. Alin Rad Pop (Secunia     Research) discovered a boundary checking error in the     reply_netbios_packet() function which could lead to a stack-based     buffer overflow (CVE-2007-5398). The Samba developers discovered a     boundary error when processing GETDC logon requests also leading to a     buffer overflow (CVE-2007-4572).
  Impact :

    To exploit the first vulnerability, a remote unauthenticated attacker     could send specially crafted WINS 'Name Registration' requests followed     by a WINS 'Name Query' request. This might lead to execution of     arbitrary code with elevated privileges. Note that this vulnerability     is exploitable only when WINS server support is enabled in Samba. The     second vulnerability could be exploited by sending specially crafted     'GETDC' mailslot requests, but requires Samba to be configured as a     Primary or Backup Domain Controller. It is not believed the be     exploitable to execute arbitrary code.
  Workaround :

    To work around the first vulnerability, disable WINS support in Samba     by setting 'wins support = no' in the 'global' section of your     smb.conf and restart Samba.

The Samba Team reports :

Secunia Research reported a vulnerability that allows for the execution of arbitrary code in nmbd. This defect may only be exploited when the 'wins support' parameter has been enabled in smb.conf.

Samba developers have discovered what is believed to be a non-exploitable buffer over in nmbd during the processing of GETDC logon server requests. This code is only used when the Samba server is configured as a Primary or Backup Domain Controller.

This update fixes all currently known regressions introduced with the previous two revisions of DSA-1409. The original text is reproduced below :

  Several local/remote vulnerabilities have been discovered in samba,   a LanManager-like file and printer server for Unix. The Common   Vulnerabilities and Exposures project identifies the following   problems :

    - CVE-2007-5398       Alin Rad Pop of Secunia Research discovered that nmbd       did not properly check the length of netbios packets.
      When samba is configured as a WINS server, a remote       attacker could send multiple crafted requests       resulting in the execution of arbitrary code with root       privileges.

    - CVE-2007-4572       Samba developers discovered that nmbd could be made to       overrun a buffer during the processing of GETDC logon       server requests. When samba is configured as a Primary       or Backup Domain Controller, a remote attacker could       send malicious logon requests and possibly cause a       denial of service.

USN-544-1 fixed two vulnerabilities in Samba. Fixes for CVE-2007-5398 are unchanged, but the upstream changes for CVE-2007-4572 introduced a regression in all releases which caused Linux smbfs mounts to fail.
Additionally, Dapper and Edgy included an incomplete patch which caused configurations using NetBIOS to fail. A proper fix for these regressions does not exist at this time, and so the patch addressing CVE-2007-4572 has been removed. This vulnerability is believed to be an unexploitable denial of service, but a future update will address this issue. We apologize for the inconvenience.

Samba developers discovered that nmbd could be made to overrun a buffer during the processing of GETDC logon server requests. When samba is configured as a Primary or Backup Domain Controller, a remote attacker could send malicious logon requests and possibly cause a denial of service. (CVE-2007-4572)

Alin Rad Pop of Secunia Research discovered that nmbd did not properly check the length of netbios packets. When samba is configured as a WINS server, a remote attacker could send multiple crafted requests resulting in the execution of arbitrary code with root privileges. (CVE-2007-5398).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New samba packages are available for Slackware 10.0, 10.1, 10.2, 11.0, 12.0, and -current to fix security issues.

The samba developers discovered that nmbd could be made to overrun a buffer during the processing of GETDC logon server requests. If samba is configured as a Primary or Backup Domain Controller, this could be used by a remote attacker to send malicious logon requests and possibly cause a denial of service (CVE-2007-4572).

As well, Alin Rad Pop of Secunia Research found that nmbd did not properly check the length of netbios packets. If samba is configured as a WINS server, this could be used by a remote attacker able to send multiple crafted requests to nmbd, resulting in the execution of arbitrary code with root privileges (CVE-2007-5398).

Update :

This update corrects all known regressions with previous Samba updates due to the security fixes to correct CVE-2007-4572.

Samba developers discovered that nmbd could be made to overrun a buffer during the processing of GETDC logon server requests. When samba is configured as a Primary or Backup Domain Controller, a remote attacker could send malicious logon requests and possibly cause a denial of service. (CVE-2007-4572)

Alin Rad Pop of Secunia Research discovered that nmbd did not properly check the length of netbios packets. When samba is configured as a WINS server, a remote attacker could send multiple crafted requests resulting in the execution of arbitrary code with root privileges.
(CVE-2007-5398).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated samba packages that fix security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Samba is a suite of programs used by machines to share files, printers, and other information.

A buffer overflow flaw was found in the way Samba creates NetBIOS replies. If a Samba server is configured to run as a WINS server, a remote unauthenticated user could cause the Samba server to crash or execute arbitrary code. (CVE-2007-5398)

A heap based buffer overflow flaw was found in the way Samba authenticates users. A remote unauthenticated user could trigger this flaw to cause the Samba server to crash. Careful analysis of this flaw has determined that arbitrary code execution is not possible, and under most circumstances will not result in a crash of the Samba server. (CVE-2007-4572)

A flaw was found in the way Samba assigned group IDs under certain conditions. If the 'winbind nss info' parameter in smb.conf is set to either 'sfu' or 'rfc2307', Samba users are incorrectly assigned the group ID of 0. (CVE-2007-4138)

Red Hat would like to thank Alin Rad Pop of Secunia Research, Rick King, and the Samba developers for responsibly disclosing these issues.

All Samba users are advised to upgrade to these updated packages, which contain a backported patch to correct these issues.

Security Fixes :

  - CVE-2007-4572

    - CVE-2007-5398

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of the Samba server on the remote host contains a boundary error in the 'reply_netbios_packet()' function in 'nmbd/nmbd_packets.c' when sending NetBIOS replies.
Provided the server is configured to run as a WINS server, a remote attacker can exploit this issue by sending multiple specially crafted WINS 'Name Registration' requests followed by a WINS 'Name Query' request, leading to a stack-based buffer overflow. This could also allow for the execution of arbitrary code.

There is also a stack buffer overflow in nmbd's logon request processing code that can be triggered by means of specially crafted GETDC mailslot requests when the affected server is configured as a Primary or Backup Domain Controller. Note that the Samba security team currently does not believe this particular issue can be exploited to execute arbitrary code remotely.

 According to its banner, the version of the Samba server on the remote host contains a boundary error in the 'reply_netbios_packet()' function in 'nmbd/nmbd_packets.c' when sending NetBIOS replies.  Provided the server is configured to run as a WINS server, a remote attacker can exploit this issue by sending multiple specially-crafted WINS 'Name Registration' requests followed by a WINS 'Name Query' request, leading to a stack-based buffer overflow and allow for execution of arbitrary code.
There is also a stack buffer overflow in nmbd's logon request processing code that can be triggered by means of specially-crafted GETDC mailslot requests when the affected server is configured as a Primary or Backup Domain Controller.  The Samba security team currently does not believe this particular vulnerability can be exploited to execute arbitrary code remotely.

SunOS 5.9_x86: Samba Patch.
Date this patch was last updated by Sun : Dec/22/10

SunOS 5.9: Samba Patch.
Date this patch was last updated by Sun : Dec/22/10

ID	Name	Product	Family	Severity
180601	Oracle Linux 5 : Critical: / samba (ELSA-2007-1017)	Nessus	Oracle Linux Local Security Checks	critical
67597	Oracle Linux 4 : samba (ELSA-2007-1016)	Nessus	Oracle Linux Local Security Checks	high
67596	Oracle Linux 3 : samba (ELSA-2007-1013)	Nessus	Oracle Linux Local Security Checks	high
67059	CentOS 4 : samba (CESA-2007:1016)	Nessus	CentOS Local Security Checks	high
63844	RHEL 4 : samba (RHSA-2007:1034)	Nessus	Red Hat Local Security Checks	high
60309	Scientific Linux Security Update : samba on SL5.x, SL4.x, SL3.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
40372	VMSA-2008-0001 : Moderate OpenPegasus PAM Authentication Buffer Overflow and updated service console packages	Nessus	VMware ESX Local Security Checks	high
37627	CentOS 3 : samba (CESA-2007:1013)	Nessus	CentOS Local Security Checks	high
29723	Mac OS X Multiple Vulnerabilities (Security Update 2007-009)	Nessus	MacOS X Local Security Checks	critical
29391	SuSE 10 Security Update : Samba (ZYPP Patch Number 4719)	Nessus	SuSE Local Security Checks	high
28370	openSUSE 10 Security Update : cifs-mount (cifs-mount-4740)	Nessus	SuSE Local Security Checks	high
28318	GLSA-200711-29 : Samba: Execution of arbitrary code	Nessus	Gentoo Local Security Checks	high
28317	FreeBSD : samba -- multiple vulnerabilities (a63b15f9-97ff-11dc-9e48-0016179b2dd5)	Nessus	FreeBSD Local Security Checks	high
28298	Debian DSA-1409-3 : samba - several vulnerabilities	Nessus	Debian Local Security Checks	high
28288	Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : samba regression (USN-544-2)	Nessus	Ubuntu Local Security Checks	high
28277	Slackware 10.0 / 10.1 / 10.2 / 11.0 / 12.0 / current : samba (SSA:2007-320-01)	Nessus	Slackware Local Security Checks	high
28274	Mandrake Linux Security Advisory : samba (MDKSA-2007:224-3)	Nessus	Mandriva Local Security Checks	high
28251	Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : samba vulnerabilities (USN-544-1)	Nessus	Ubuntu Local Security Checks	high
28246	RHEL 5 : samba (RHSA-2007:1017)	Nessus	Red Hat Local Security Checks	high
28245	RHEL 4 : samba (RHSA-2007:1016)	Nessus	Red Hat Local Security Checks	high
28244	RHEL 2.1 / 3 : samba (RHSA-2007:1013)	Nessus	Red Hat Local Security Checks	high
28229	Fedora 7 : samba-3.0.27-0.fc7 (2007-3402)	Nessus	Fedora Local Security Checks	high
28228	Samba < 3.0.27 Multiple Vulnerabilities	Nessus	Misc.	high
4285	Samba < 3.0.27 Multiple Vulnerabilities	Nessus Network Monitor	Samba	critical
13609	Solaris 9 (x86) : 114685-17	Nessus	Solaris Local Security Checks	high
13559	Solaris 9 (sparc) : 114684-17	Nessus	Solaris Local Security Checks	high

Detections

Analytics

CVE-2007-5398

critical

Tenable Plugins

critical

high

high

high

high

high

high

high

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

critical

high

high