Multiple format string vulnerabilities in client/client.c in smbclient in Samba 3.2.0 through 3.2.12 might allow context-dependent attackers to execute arbitrary code via format string specifiers in a filename.

J. David Hester discovered that Samba incorrectly handled users that lack home directories when the automated [homes] share is enabled. An authenticated user could connect to that share name and gain access to the whole filesystem. (CVE-2009-2813)

Tim Prouty discovered that the smbd daemon in Samba incorrectly handled certain unexpected network replies. A remote attacker could send malicious replies to the server and cause smbd to use all available CPU, leading to a denial of service. (CVE-2009-2906)

Ronald Volgers discovered that the mount.cifs utility, when installed as a setuid program, would not verify user permissions before opening a credentials file. A local user could exploit this to use or read the contents of unauthorized credential files. (CVE-2009-2948)

Reinhard Nissl discovered that the smbclient utility contained format string vulnerabilities in its file name handling. Because of security features in Ubuntu, exploitation of this vulnerability is limited. If a user or automated system were tricked into processing a specially crafted file name, smbclient could be made to crash, possibly leading to a denial of service. This only affected Ubuntu 8.10.
(CVE-2009-1886)

Jeremy Allison discovered that the smbd daemon in Samba incorrectly handled permissions to modify access control lists when dos filemode is enabled. A remote attacker could exploit this to modify access control lists. This only affected Ubuntu 8.10 and Ubuntu 9.04.
(CVE-2009-1886).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fixed a format string vulnerability in smbclient (CVE-2009-1886) and a ACL bypass vulnerability in samba. (CVE-2009-1888)

Also a printing issue in KRB5 setups was fixed.

Fixed a format string vulnerability in smbclient (CVE-2009-1886) and a ACL bypass vulnerability in samba. (CVE-2009-1888)

Multiple vulnerabilities has been found and corrected in samba :

Multiple format string vulnerabilities in client/client.c in smbclient in Samba 3.2.0 through 3.2.12 might allow context-dependent attackers to execute arbitrary code via format string specifiers in a filename (CVE-2009-1886).

The acl_group_override function in smbd/posix_acls.c in smbd in Samba 3.0.x before 3.0.35, 3.1.x and 3.2.x before 3.2.13, and 3.3.x before 3.3.6, when dos filemode is enabled, allows remote attackers to modify access control lists for files via vectors related to read access to uninitialized memory (CVE-2009-1888).

This update provides samba 3.2.13 to address these issues.

Fixed a format string vulnerability in smbclient (CVE-2009-1886) and a ACL bypass vulnerability in samba (CVE-2009-1888).

Several vulnerabilities have been discovered in Samba, a SMB/CIFS file, print, and login server. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-1886     The smbclient utility contains a formatstring     vulnerability where commands dealing with file names     treat user input as format strings to asprintf.

  - CVE-2009-1888     In the smbd daemon, if a user is trying to modify an     access control list (ACL) and is denied permission, this     deny may be overridden if the parameter 'dos filemode'     is set to 'yes' in the smb.conf and the user already has     write access to the file.

New samba packages are available for Slackware 10.0, 10.1, 10.2, 11.0, 12.0, 12.1, 12.2, and -current to fix security issues.

According to its version number, the version of Samba running on the remote host has a security bypass vulnerability.  Access restrictions can be bypassed due to a read of uninitialized data in smbd.  This could allow a user to modify an access control list (ACL), even when they should be denied permission.

Note the 'dos filemode' parameter must be set to 'yes' in smb.conf in order for an attack to be successful (the default setting is 'no').

Also note versions 3.2.0 - 3.2.12 of smbclient are affected by a format string vulnerability, though Nessus has not checked for this.

According to its banner, the version of the Samba server on the remote host has a security bypass vulnerability. Access restrictions can be bypassed due to a read of uninitialized data in smbd. This could allow a user to modify an access control list (ACL), even when they should be denied permission.

Note the 'dos filemode' parameter must be set to 'yes' in smb.conf in order for an attack to be successful (the default setting is 'no').

ID	Name	Product	Family	Severity
41968	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 : samba vulnerabilities (USN-839-1)	Nessus	Ubuntu Local Security Checks	high
41483	SuSE 10 Security Update : Samba (ZYPP Patch Number 6343)	Nessus	SuSE Local Security Checks	high
41372	SuSE 11 Security Update : Samba (SAT Patch Number 1053)	Nessus	SuSE Local Security Checks	high
40521	Mandriva Linux Security Advisory : samba (MDVSA-2009:196)	Nessus	Mandriva Local Security Checks	high
40198	openSUSE Security Update : cifs-mount (cifs-mount-1036)	Nessus	SuSE Local Security Checks	high
39928	openSUSE Security Update : cifs-mount (cifs-mount-1036)	Nessus	SuSE Local Security Checks	high
39568	Debian DSA-1823-1 : samba - several vulnerabilities	Nessus	Debian Local Security Checks	high
39559	Slackware 10.0 / 10.1 / 10.2 / 11.0 / 12.0 / 12.1 / 12.2 / current : samba (SSA:2009-177-01)	Nessus	Slackware Local Security Checks	high
39502	Samba < 3.0.35 / 3.2.13 / 3.3.6 Multiple Vulnerabilities	Nessus	Misc.	low
5087	Samba < 3.3.6 / 3.2.13 / 3.0.35 Multiple Vulnerabilities	Nessus Network Monitor	Samba	high

Detections

Analytics

CVE-2009-1886

critical

Tenable Plugins

high

high

high

high

high

high

high

high

low

high