Detections
Analytics
Samba < 3.0.30 receive_smb_raw Function Remote Buffer Overflow
high Nessus Plugin ID 32476
Language:
Synopsis
The remote Samba server may be affected by a buffer overflow vulnerability.Description
According to its banner, the version of the Samba server on the remote host is reportedly affected by a boundary error in 'nmbd' within the 'receive_smb_raw' function in 'lib/util_sock.c' when parsing SMB packets received in a client context. By sending specially crafted packets to an 'nmbd' server configured as a local or domain master browser, an attacker can leverage this issue to produce a heap-based buffer overflow and execute arbitrary code with system privileges.Note that Nessus has not actually tried to exploit this issue, verify the remote 'nmbd' server's configuration, or determine if the fix has been applied.
Solution
Upgrade to Samba version 3.0.30 or later or apply the patch referenced in the project's advisory.See Also
https://secuniaresearch.flexerasoftware.com/secunia_research/2008-20/advisory/
Plugin Details
Severity: High
ID: 32476
File Name: samba_3_0_30.nasl
Version: 1.15
Type: remote
Family: Misc.
Published: 5/29/2008
Updated: 11/15/2018
Configuration: Enable paranoid mode
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.0
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.9
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: cpe:/a:samba:samba
Required KB Items: Settings/ParanoidReport, SMB/samba, SMB/NativeLanManager
Exploit Available: true
Exploit Ease: Exploits are available
Reference Information
CVE: CVE-2008-1105
BID: 29404