Note: This is an archival copy of Security Sun Alert 237764 as previously published on http://sunsolve.sun.com.|
Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1019254.1.
Date of Workaround Release
Date of Resolved Release
Two Security Vulnerabilities in samba(7) WINS Server Daemon (see details below)
1. ImpactTwo security vulnerabilities in the samba(7) WINS server daemon (nmbd) may allow a remote unprivileged user to execute arbitrary code with the privileges of the Samba nmbd daemon or lead to a Denial of Service (DoS) to the Samba WINS service.
These issues are described in the following documents:
2. Contributing FactorsThese issues can occur in the following releases:
% ps -ef | grep mbd
root 317 1 0 May 26 ? 0:01 /usr/sfw/sbin/smbd -D
root 325 317 0 May 26 ? 0:00 /usr/sfw/sbin/smbd -D
root 314 1 0 May 26 ? 0:27 /usr/sfw/sbin/nmbd -D
root 28369 17382 0 23:17:46 pts/2 0:00 grep mbd
If the output shows "smbd" or "nmbd" running as a daemon (with the -D parameter), the system is configured as a Samba server.
To determine the version of Samba installed on a system, the following command can be run:
% /usr/sfw/sbin/smbd -V
To determine if the Samba server is running as a Samba WINS server, the following steps may be used:
1. Verify that the process "/usr/sfw/sbin/nmbd -D" is running. This may be done by using the ps(1) command as indicated above.
2. Verify that the "wins support" configuration parameter is set to "yes" in the "/etc/sfw/smb.conf" file.
3. SymptomsIf the issue described in CVE-2007-4572 is exploited, the "nmbd" process may hang or the WINS server may stop servicing WINS names.
There are no predictable symptoms to indicate that the issue described in CVE-2007-5398 has been exploited to execute arbitrary code.
4. WorkaroundTo work around these issues, stop running the Samba server as a WINS Server. This may achieved by modifying the "wins support" entry in the "/etc/sfw/smb.conf" configuration file to "no".
Note: The Samba server must be restarted after making this modification for the changes to take effect.
5. ResolutionThese issues are addressed in the following releases:
For more information on Security Sun Alerts, see 1009886.1
Copyright 2000-2008 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved.
11-Jun-2008: Updated Contributing Factors and Resolution sections. Resolved
Solaris 9 Operating System
Solaris 10 Operating System
This solution has no attachment