Enterprise Linux Log

Nov 15 2007   10:55AM GMT

Security alert: Remote Code Execution in Samba’s nmbd

ITKE ITKE Profile: ITKE

Samba release manage Jerry Carter once told me that the majority of “bugs” in Samba that get reported by users are actually misconfigurations of that user’s system, or a problem with Microsoft Windows, and are not the fault of Samba.

In one of the rare tips I’ve written for SearchEnterpriseLinux.com, Carter said the next time a user comes knocking on your door with an Access Denied error message and blames it on Samba, tell them to slow down. Most of the time, it’s not Samba’s fault, he said. “Our motto is ‘Bug for bug, feature for feature, we are completely compatible with Microsoft Windows,” Carter said.

However, Carter also said that if there was a legitimate bug, the Samba team had no problem admitting it existed and working post haste to get it resolved. Today, the Samba team reported a security issue with Samba’s code, as well as a patch to fix it.

Description
===========

Secunia Research reported a vulnerability that allows for the execution of arbitrary code in nmbd. This defect may only be exploited when the “wins support” parameter has been enabled in smb.conf.

Patch Availability
==================

A patch addressing this defect has been posted to

http://www.samba.org/samba/security/

Additionally, Samba 3.0.27 has been issued as a security release to correct the defect.

Workaround
==========

Samba administrators may avoid this security issue by disabling the “wins support” feature in the hosts smb.conf file.

Credits
=======

This vulnerability was reported to Samba developers by Alin Rad Pop, Secunia Research.

The time line is as follows:

  • Oct 30, 2007: Initial report to security@samba.org.
  • Oct 30, 2007: First response from Samba developers confirming the bug along with a proposed patch.
  • Nov 15, 2007: Public security advisory to be made available.

“Our Code, Our Bugs, Our Responsibility.” – The Samba Team

 Comment on this Post

 
There was an error processing your information. Please try again later.
Thanks. We'll let you know when a new response is added.
Send me notifications when other members comment.

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy

Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to: