Bug 446724 (CVE-2008-1105)

Summary: CVE-2008-1105 Samba client buffer overflow
Product: [Other] Security Response Reporter: Josh Bressers <bressers>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: urgent Docs Contact:
Priority: urgent    
Version: unspecifiedCC: jmorris, kreilly, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2008-06-16 13:48:21 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 446727, 446728, 446729, 446730, 446731, 446732, 446959    
Bug Blocks:    
Attachments:
Description Flags
Proposed upstream patch for Samba 3.0
none
Updated upstream patch for Samba 3.0 none

Description Josh Bressers 2008-05-15 19:19:22 UTC 
Alin Rad Pop of Secunia Research discovered a heap based buffer overflow flaw in
the Samba client library.  A boundary error in the receive_smb_raw() function
could allow an overly large SMB packet to execute arbitrary code as the user
running the client.

Acknowledgements:

Red Hat would like to thank Alin Rad Pop of Secunia Research for responsibly disclosing this issue.
Comment 2 Josh Bressers 2008-05-15 20:08:03 UTC 
Created attachment 305534 [details]
Proposed upstream patch for Samba 3.0
Comment 3 Tomas Hoger 2008-05-16 06:34:58 UTC 
Created attachment 305636 [details]
Updated upstream patch for Samba 3.0

Corrects the comment in lib/util_sock.c to remove the incorrect function
contract description. No other functional change to the previous patch.
Comment 8 Tomas Hoger 2008-05-28 10:42:47 UTC 
Public now, lifting embargo:

  http://secunia.com/advisories/30228/
  http://secunia.com/secunia_research/2008-20/advisory/
Comment 9 Fedora Update System 2008-05-28 14:20:49 UTC 
samba-3.2.0-1.rc1.14.fc9 has been submitted as an update for Fedora 9
Comment 10 Tomas Hoger 2008-05-28 15:04:36 UTC 
Upstream released samba 3.0.30 to address this flaw:

  http://www.samba.org/samba/security/CVE-2008-1105.html
Comment 13 Fedora Update System 2008-05-31 02:11:24 UTC 
samba-3.0.30-0.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 14 Fedora Update System 2008-05-31 02:13:49 UTC 
samba-3.2.0-1.rc1.14.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 15 Fedora Update System 2008-05-31 02:17:24 UTC 
samba-3.0.28a-1.fc7 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 16 Red Hat Product Security 2008-06-16 13:48:21 UTC 
This issue was addressed in:

Red Hat Enterprise Linux:
  http://rhn.redhat.com/errata/RHSA-2008-0288.html
  http://rhn.redhat.com/errata/RHSA-2008-0289.html
  http://rhn.redhat.com/errata/RHSA-2008-0290.html

Fedora:
  https://admin.fedoraproject.org/updates/F7/FEDORA-2008-4797
  https://admin.fedoraproject.org/updates/F8/FEDORA-2008-4679
  https://admin.fedoraproject.org/updates/F9/FEDORA-2008-4724