Overview
Samba fails to properly handle malformed MS-RPC packets. Exploitation of this vulnerability could allow a remote attacker to execute arbitrary code.
Description
Samba is a widely used open-source implementation of Server Message Block (SMB)/Common Internet File System (CIFS). Network Data Representation (NDR) is the scheme to encode MS-RPC data for transport. Samba fails to properly validate MS-RPC packets. Specifically, Samba's NDR functions do not properly validate arguments supplied to memory allocation routines. This results in a buffer of insufficient size being allocated. When data is copied to this buffer, a heap-based buffer overflow may occur. More information is available in Samba's Security Announcement. |
Impact
A remote attacker may be able to execute arbitrary code. |
Solution
Apply a patch or upgrade |
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
- http://samba.org/samba/security/CVE-2007-2446.html
- http://samba.org/samba/history/security.html
- http://www.samba.org/samba/history/samba-3.0.25.html
- http://secunia.com/advisories/25232/
- http://www.zerodayinitiative.com/advisories/ZDI-07-029.html
- http://www.zerodayinitiative.com/advisories/ZDI-07-030.html
- http://www.zerodayinitiative.com/advisories/ZDI-07-031.html
- http://www.zerodayinitiative.com/advisories/ZDI-07-032.html
- http://www.zerodayinitiative.com/advisories/ZDI-07-033.html
- http://www.iss.net/threats/266.html
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-102964-1
- http://docs.info.apple.com/article.html?artnum=306172
Acknowledgements
This vulnerability was reported by the Samba Team. Samba, in turn credits Brian Schafer of TippingPoint.
This document was written by Jeff Gennari.
Other Information
| CVE IDs: | CVE-2007-2446 |
| Severity Metric: | 7.65 |
| Date Public: | 2007-05-14 |
| Date First Published: | 2007-05-14 |
| Date Last Updated: | 2007-08-08 17:39 UTC |
| Document Revision: | 34 |