Security Vulnerability in samba(7) Specially Crafted Packet May Expose Arbitrary Buffer of Data

---

Security Vulnerability in samba(7) Specially Crafted Packet May Expose Arbitrary Buffer of Data

1. Impact

An information disclosure security vulnerability in Samba (SAMBA(7)) may allow a remote unprivileged user to read arbitrary memory buffer contents and cause a Denial of Service (DoS) via crafted requests.

Additional information on this issue can be found in the following document:


2. Contributing Factors

SPARC Platform

• Solaris 9 with patch 114684-12 and without patch 114684-13
• Solaris 10 with patch 119757-13 and without patch 119757-14
  
• OpenSolaris based upon builds snv_92 through snv_105
  

x86 Platform

• Solaris 9 with patch 114685-12 and without patch 114685-13
• Solaris 10 with patch 119758-13 and without patch 119758-14
  
• OpenSolaris based upon builds snv_92 through snv_105

with the following versions of Samba software:

• Samba 3.0.0 through 3.0.29

Notes:

1. Solaris 8 does not include the Samba software and is therefore not affected by this issue.

To determine the version of Samba installed on a system, the following command can be run:

% /usr/sfw/sbin/smbd -V
Version  3.0.4

To determine if a system is configured as a Samba server, the following command can be run to check for processes related to Samba:

% ps -ef | grep mbd
root   317     1   0   May 26 ?           0:01 /usr/sfw/sbin/smbd -D
root   325   317   0   May 26 ?           0:00 /usr/sfw/sbin/smbd -D
root   314     1   0   May 26 ?           0:27 /usr/sfw/sbin/nmbd -D
root 28369 17382   0 23:17:46 pts/2       0:00 grep mbd

If the output shows "smbd" or "nmbd" running as a daemon (with the -D parameter), the system is configured as a Samba server.

3. Symptoms

There are no predictable symptoms that would indicate the described vulnerability has been exploited to compromise the arbitrary memory contents.

4. Workaround

To work around the described issue for the Samba server, the Samba service may be stopped by using the following command:

On Solaris 9:

# /etc/init.d/samba stop

On Solaris 10 and later:

# svcadm disable samba

5. Resolution

This issue is addressed in the following releases:

SPARC Platform

• Solaris 9 with patch 114684-13 or later
• Solaris 10 with patch 119757-14 or later
  
• OpenSolaris based upon builds snv_106 or later

x86 Platform

• Solaris 9 with patch 114685-13 or later
• Solaris 10 with patch 119758-14 or later
  
• OpenSolaris based upon builds snv_106 or later

For more information on Security Sun Alerts, see Technical Instruction ID 213557.

This Sun Alert notification is being provided to you on an "AS IS" basis. This Sun Alert notification may contain information provided by third parties. The issues described in this Sun Alert notification may or may not impact your system(s). Sun makes no representations, warranties, or guarantees as to the information contained herein. ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT YOU ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. This Sun Alert notification contains Sun proprietary and confidential information. It is being provided to you pursuant to the provisions of your agreement to purchase services from Sun, or, if you do not have such an agreement, the Sun.com Terms of Use. This Sun Alert notification may only be used for the purposes contemplated by these agreements.

Copyright 2000-2009 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved.

Modification History

30-Jan-2009: Updated Contributing Factors and Resolution sections for Solaris 9
02-Feb-2009: Updated Contributing Factors and Resolution sections for Solaris 10; now Resolved

Attachments

This solution has no attachment