Bug 472298 (CVE-2008-4314) - CVE-2008-4314 samba: arbitrary memory disclosure
Summary: CVE-2008-4314 samba: arbitrary memory disclosure
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2008-4314
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 472299
Blocks:
TreeView+ depends on / blocked
 
Reported: 2008-11-19 21:53 UTC by Josh Bressers
Modified: 2021-11-12 19:52 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2008-12-03 07:35:07 UTC


Attachments (Terms of Use)
Proposed upstream patch (1.87 KB, patch)
2008-11-19 22:03 UTC, Josh Bressers
no flags Details | Diff

Description Josh Bressers 2008-11-19 21:53:26 UTC
Quoting the Samba advisory:

Samba 3.0.29 and beyond contain a change to deal with gcc 4
optimizations. Part of the change modified range checking for client-generated
offsets of secondary trans, trans2 and nttrans requests. These requests are
used to transfer arbitrary amounts of memory from clients to servers and back
using small SMB requests and contain two offsets: One offset (A) pointing into
the PDU sent by the client and one (B) to direct the transferred contents into
the buffer built on the server side. While the range checking for offset (B) is
correct, a cut&paste error lets offset (A) pass completely unchecked against
overflow.

The buffers passed into trans, trans2 and nttrans undergo higher-level
processing like DCE/RPC requests or listing directories. The missing bounds
check means that a malicious client can make the server do this higher-level
processing on arbitrary memory contents of the smbd process handling the
request. It is unknown if that can be abused to pass arbitrary memory contents
back to the client, but an important barrier is missing from the affected Samba
versions.

Comment 2 Josh Bressers 2008-11-19 22:03:45 UTC
Created attachment 324105 [details]
Proposed upstream patch

Comment 3 Tomas Hoger 2008-11-27 13:43:08 UTC
Public now via:
  http://www.samba.org/samba/security/CVE-2008-4314.html

Affected version:
  Samba 3.0.29 - 3.2.4 (inclusive)

Fixed upstream in:
  Samba 3.2.5 and 3.0.33

Upstream patches for 3.2.x and 3.0.x:
http://www.samba.org/samba/ftp/patches/security/samba-3.2.4-CVE-2008-4314.patch
http://www.samba.org/samba/ftp/patches/security/samba-3.0.32-CVE-2008-4314.patch

Comment 4 Tomas Hoger 2008-11-27 14:07:05 UTC
This issue did not affect version of Samba as shipped with Red Hat Enterprise Linux 2.1, 3, 4 and 5.

Comment 5 Fedora Update System 2008-12-03 01:12:36 UTC
samba-3.2.5-0.22.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Fedora Update System 2008-12-03 01:22:50 UTC
samba-3.2.5-0.23.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 7 Fedora Update System 2008-12-03 01:24:43 UTC
samba-3.0.33-0.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.