This service will be undergoing maintenance at 00:00 UTC, 2016-08-01. It is expected to last about 1 hours
Bug 472298 - (CVE-2008-4314) CVE-2008-4314 samba: arbitrary memory disclosure
CVE-2008-4314 samba: arbitrary memory disclosure
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
source=upstream,reported=20081111,pub...
: Security
Depends On: 472299
Blocks:
  Show dependency treegraph
 
Reported: 2008-11-19 16:53 EST by Josh Bressers
Modified: 2008-12-03 02:35 EST (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-12-03 02:35:07 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)
Proposed upstream patch (1.87 KB, patch)
2008-11-19 17:03 EST, Josh Bressers
no flags Details | Diff

  None (edit)
Description Josh Bressers 2008-11-19 16:53:26 EST
Quoting the Samba advisory:

Samba 3.0.29 and beyond contain a change to deal with gcc 4
optimizations. Part of the change modified range checking for client-generated
offsets of secondary trans, trans2 and nttrans requests. These requests are
used to transfer arbitrary amounts of memory from clients to servers and back
using small SMB requests and contain two offsets: One offset (A) pointing into
the PDU sent by the client and one (B) to direct the transferred contents into
the buffer built on the server side. While the range checking for offset (B) is
correct, a cut&paste error lets offset (A) pass completely unchecked against
overflow.

The buffers passed into trans, trans2 and nttrans undergo higher-level
processing like DCE/RPC requests or listing directories. The missing bounds
check means that a malicious client can make the server do this higher-level
processing on arbitrary memory contents of the smbd process handling the
request. It is unknown if that can be abused to pass arbitrary memory contents
back to the client, but an important barrier is missing from the affected Samba
versions.
Comment 2 Josh Bressers 2008-11-19 17:03:45 EST
Created attachment 324105 [details]
Proposed upstream patch
Comment 3 Tomas Hoger 2008-11-27 08:43:08 EST
Public now via:
  http://www.samba.org/samba/security/CVE-2008-4314.html

Affected version:
  Samba 3.0.29 - 3.2.4 (inclusive)

Fixed upstream in:
  Samba 3.2.5 and 3.0.33

Upstream patches for 3.2.x and 3.0.x:
http://www.samba.org/samba/ftp/patches/security/samba-3.2.4-CVE-2008-4314.patch
http://www.samba.org/samba/ftp/patches/security/samba-3.0.32-CVE-2008-4314.patch
Comment 4 Tomas Hoger 2008-11-27 09:07:05 EST
This issue did not affect version of Samba as shipped with Red Hat Enterprise Linux 2.1, 3, 4 and 5.
Comment 5 Fedora Update System 2008-12-02 20:12:36 EST
samba-3.2.5-0.22.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 6 Fedora Update System 2008-12-02 20:22:50 EST
samba-3.2.5-0.23.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 7 Fedora Update System 2008-12-02 20:24:43 EST
samba-3.0.33-0.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.