Rapid7 Vulnerability & Exploit Database

RHSA-2002:266: New samba packages available to fix potential security vulnerability

Back to Search

RHSA-2002:266: New samba packages available to fix potential security vulnerability

Severity
10
CVSS
(AV:N/AC:L/Au:N/C:C/I:C/A:C)
Published
12/11/2002
Created
07/25/2018
Added
10/28/2005
Modified
07/04/2017

Description

New samba packages are available that fix a security vulnerability present in samba versions 2.2.2 through 2.2.6. A potential attacker could gain root access on the target machine. It is strongly encouraged that all Samba users update to the fixed packages. As of this time, there are no known exploits for this vulnerability.

There was a bug in the length checking for encrypted password change requests from clients. A client could potentially send an encrypted password, which, when decrypted with the old hashed password, could be used as a buffer overrun attack on smbd's stack. The attack would have to be crafted such that converting a DOS codepage string to little endian UCS2 unicode would translate into an executable block of code. Thanks to the Debian Samba maintainers for discovering this issue, and to the Samba team for providing the fix (and the problem description text above.)

Solution(s)

  • redhat-upgrade-samba
  • redhat-upgrade-samba-client
  • redhat-upgrade-samba-common
  • redhat-upgrade-samba-swat

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;