RHSA-2002:266: New samba packages available to fix potential security vulnerability

Description

New samba packages are available that fix a security vulnerability present in samba versions 2.2.2 through 2.2.6. A potential attacker could gain root access on the target machine. It is strongly encouraged that all Samba users update to the fixed packages. As of this time, there are no known exploits for this vulnerability.

There was a bug in the length checking for encrypted password change requests from clients. A client could potentially send an encrypted password, which, when decrypted with the old hashed password, could be used as a buffer overrun attack on smbd's stack. The attack would have to be crafted such that converting a DOS codepage string to little endian UCS2 unicode would translate into an executable block of code. Thanks to the Debian Samba maintainers for discovering this issue, and to the Samba team for providing the fix (and the problem description text above.)