Serious Samba Problems

May 17, 2007

Three critical bugs in the popular open-source program allow for system compromise.

Samba is a very popular free and open-source program for providing file-sharing services compatible with Microsoft Windows'. It is used extensively on Linux and other UNIX-variant operating systems.

The Samba team this week revealed three critical bugs in all versions of the software since 3.0, and released patches to bring it up to the new current (stable) release of 3.0.24. The three errors:

Remote Command Injection Vulnerability - Unescaped user input parameters are passed as arguments to /bin/sh allowing for remote command execution.

Multiple Heap Overflows Allow Remote Code Execution - Various bugs in Samba's NDR parsing can allow a user to send specially crafted MS-RPC requests that will overwrite the heap space with user defined data.

Local SID/Name translation bug can result in user privilege elevation - An error in the software could allow elevation to root.

It's not typical for Samba servers to be exposed directly to the Internet with vulnerable protocols left unfiltered, but attacks could be launched from within the network.

Samba is used in a wide variety of products, including NAS appliances. It's important to assess if you have any such products and to update them periodically to address problems such as these.

Rate this story - 4 /5 (1 vote)

rank
1
2
3
4
5

view popular

Other News

Panasonic Develops High Energy Lithium-ion Battery Module with High Reliability

Panasonic plans home-use storage cell

Technology / Energy

Dec 23, 2009 | 4.1 / 5 (19) | 9

Panasonic Corp., which recently made a successful takeover bid for Sanyo Electric Co., plans to market a lithium-ion storage cell for home use around fiscal 2011.

Taiwan has unveiled what it calls Asia's biggest solar power plant

Taiwan unveils Asia's biggest solar plant: govt

Technology / Energy

Dec 23, 2009 | 3.3 / 5 (6) | 3

Taiwan has unveiled what it calls Asia's biggest solar power plant as the island, which imports almost all its energy, seeks to tap into clean renewable resources, the government said Wednesday.

Comcast settles data discrimination lawsuit

Technology / Internet

Dec 23, 2009 | not rated yet | 2

(AP) -- Comcast will pay up to $16 million to settle a class-action lawsuit accusing the cable TV operator of delaying certain Internet traffic.

NORAD is tracking Santa Claus's progress

Follow Santa Claus, courtesy Google and NORAD

Technology / Internet

Dec 24, 2009 | 3.4 / 5 (5) | 0

Santa Claus is coming to your town -- and NORAD is tracking him as he drops off presents around the world. The North American Aerospace Defense Command, which monitors the North American airspace, on Thursday ...

A man uses a laptop computer at a wireless cafe

China cracks down on online games: report

Technology / Internet

13 hours ago | not rated yet | 0

China has placed more than 4.65 million computers at some 80,000 Internet cafes under watch in a bid to crack down on violent or pornographic online games, state media reported Friday.