Note: This is an archival copy of Security Sun Alert 249087 as previously published on http://sunsolve.sun.com.
Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1019924.1.
Article ID : 1019924.1
Article Type : Sun Alerts (SURE)
Last reviewed : 2009-02-01
Audience : PUBLIC
Copyright Notice: Copyright © 2010, Oracle Corporation and/or its affiliates.

Security Vulnerability in samba(7) Specially Crafted Packet May Expose Arbitrary Buffer of Data

Category
Security

Release Phase
Resolved

Bug Id
6773861

Product
Solaris 9 Operating System
Solaris 10 Operating System
SAMBA

Date of Workaround Release
08-Jan-2009

Date of Resolved Release
02-Feb-2009

Security Vulnerability in samba(7) Specially Crafted Packet May Expose Arbitrary Buffer of Data

1. Impact

An information disclosure security vulnerability in Samba (SAMBA(7)) may allow a remote unprivileged user to read arbitrary memory buffer contents and cause a Denial of Service (DoS) via crafted requests.

Additional information on this issue can be found in the following document:


2. Contributing Factors

SPARC Platform
  • Solaris 9 with patch 114684-12 and without patch 114684-13
  • Solaris 10 with patch 119757-13 and without patch 119757-14
  • OpenSolaris based upon builds snv_92 through snv_105
x86 Platform
  • Solaris 9 with patch 114685-12 and without patch 114685-13
  • Solaris 10 with patch 119758-13 and without patch 119758-14
  • OpenSolaris based upon builds snv_92 through snv_105
with the following versions of Samba software:
  • Samba 3.0.0 through 3.0.29
Notes:

1. Solaris 8 does not include the Samba software and is therefore not affected by this issue.

To determine the version of Samba installed on a system, the following command can be run:
% /usr/sfw/sbin/smbd -V
Version  3.0.4
To determine if a system is configured as a Samba server, the following command can be run to check for processes related to Samba:
% ps -ef | grep mbd
root   317     1   0   May 26 ?           0:01 /usr/sfw/sbin/smbd -D
root   325   317   0   May 26 ?           0:00 /usr/sfw/sbin/smbd -D
root   314     1   0   May 26 ?           0:27 /usr/sfw/sbin/nmbd -D
root 28369 17382   0 23:17:46 pts/2       0:00 grep mbd
If the output shows "smbd" or "nmbd" running as a daemon (with the -D parameter), the system is configured as a Samba server.

3. Symptoms

There are no predictable symptoms that would indicate the described vulnerability has been exploited to compromise the arbitrary memory contents.

4. Workaround

To work around the described issue for the Samba server, the Samba service may be stopped by using the following command:

On Solaris 9:
# /etc/init.d/samba stop
On Solaris 10 and later:
# svcadm disable samba

5. Resolution

This issue is addressed in the following releases:

SPARC Platform
  • Solaris 9 with patch 114684-13 or later
  • Solaris 10 with patch 119757-14 or later
  • OpenSolaris based upon builds snv_106 or later
x86 Platform
  • Solaris 9 with patch 114685-13 or later
  • Solaris 10 with patch 119758-14 or later
  • OpenSolaris based upon builds snv_106 or later
For more information on Security Sun Alerts, see 1009886.1.

This Sun Alert notification is being provided to you on an "AS IS" basis. This Sun Alert notification may contain information provided by third parties. The issues described in this Sun Alert notification may or may not impact your system(s). Sun makes no representations, warranties, or guarantees as to the information contained herein. ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT YOU ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. This Sun Alert notification contains Sun proprietary and confidential information. It is being provided to you pursuant to the provisions of your agreement to purchase services from Sun, or, if you do not have such an agreement, the Sun.com Terms of Use. This Sun Alert notification may only be used for the purposes contemplated by these agreements.

Copyright 2000-2009 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved.


Modification History
30-Jan-2009: Updated Contributing Factors and Resolution sections for Solaris 9
02-Feb-2009: Updated Contributing Factors and Resolution sections for Solaris 10; now Resolved


References
 114684-13

 114685-13

 119757-14

 119758-14



                               



Attachments
This solution has no attachment