New samba packages are available that fix a security vulnerability present in samba versions 2.2.2 through 2.2.6. A potential attacker could gain root access on the target machine. It is strongly encouraged that all Samba users update to the fixed packages. As of this time, there are no known exploits for this vulnerability.
There was a bug in the length checking for encrypted password change requests from clients. A client could potentially send an encrypted password, which, when decrypted with the old hashed password, could be used as a buffer overrun attack on smbd's stack. The attack would have to be crafted such that converting a DOS codepage string to little endian UCS2 unicode would translate into an executable block of code. Thanks to the Debian Samba maintainers for discovering this issue, and to the Samba team for providing the fix (and the problem description text above.)
With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.
– Scott Cheney, Manager of Information Security, Sierra View Medical Center