[CVE-2008-1105] Samba: boundary failure when parsing SMB responses

[Till Ulen]

Binary package hint: samba

CVE-2008-1105 description:

"Heap-based buffer overflow in the receive_smb_raw function in util/sock.c in Samba 3.0.0 through 3.0.29 allows remote attackers to execute arbitrary code via a crafted SMB response."

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2008-1105
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1105

"Boundary failure when parsing SMB responses can result in a buffer overrun

Specifically crafted SMB responses can result in a heap overflow in the Samba client code.
Because the server process, smbd, can itself act as a client during operations such as
printer notification and domain authentication, this issue affects both Samba client and
server installations."

http://www.samba.org/samba/security/CVE-2008-1105.html

Patch: http://www.samba.org/samba/ftp/patches/security/samba-3.0.29-CVE-2008-1105.patch

[Till Ulen (tillulen)]

DSA 1590-1: http://www.debian.org/security/2008/dsa-1590 (link not functioning yet)

[Jamie Strandboge (jdstrand)]

 samba (1:3.0.30-1) unstable; urgency=high

   * New upstream release: fix a heap overflow when parsing SMB responses in
     client code. (CVE-2008-1105). Closes: #483410

[Launchpad Janitor (janitor)]

This bug was fixed in the package samba - 3.0.28a-1ubuntu4.2

---------------
samba (3.0.28a-1ubuntu4.2) hardy-security; urgency=low

  * SECURITY UPDATE: heap overflow when processing crafted SMB responses
  * debian/patches/security-CVE-2008-1105.patch: update util_sock.c to require
    specifying the buffer size and update client.c, smbctool.c, smbfilter.c,
    and process.c for these changes
  * References:
    CVE-2008-1105
    LP: #235912

 -- Jamie Strandboge <email address hidden> Tue, 17 Jun 2008 12:47:38 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package samba - 3.0.26a-1ubuntu2.4

---------------
samba (3.0.26a-1ubuntu2.4) gutsy-security; urgency=low

  * SECURITY UPDATE: heap overflow when processing crafted SMB responses
  * debian/patches/security-CVE-2008-1105.patch: update util_sock.c to require
    specifying the buffer size and update client.c, smbctool.c, smbfilter.c,
    and process.c for these changes
  * SECURITY UPDATE: buffer overrun in nmbd when processing crafted GETDC
    mailslot requests
  * debian/patches/security_CVE-2007-4572.patch: check return values and
    sizeof strings in charcnv.c, ntlmssp_parse.c, nmbd_processlogon.c.
    Backport regression fixes from upstream.
  * References:
    CVE-2008-1105
    CVE-2007-4572
    LP: #235912

 -- Jamie Strandboge <email address hidden> Tue, 03 Jun 2008 16:29:05 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package samba - 3.0.24-2ubuntu1.6

---------------
samba (3.0.24-2ubuntu1.6) feisty-security; urgency=low

  * SECURITY UPDATE: heap overflow when processing crafted SMB responses
  * debian/patches/security-CVE-2008-1105.patch: update util_sock.c to require
    specifying the buffer size and update client.c, smbctool.c, smbfilter.c,
    and process.c for these changes
  * SECURITY UPDATE: buffer overrun in nmbd when processing crafted GETDC
    mailslot requests
  * debian/patches/security_CVE-2007-4572.patch: check return values and
    sizeof strings in charcnv.c, ntlmssp_parse.c, nmbd_processlogon.c.
    Backport regression fixes from upstream.
  * References:
    CVE-2008-1105
    CVE-2007-4572
    LP: #235912

 -- Jamie Strandboge <email address hidden> Mon, 16 Jun 2008 14:24:29 -0400

[Jamie Strandboge (jdstrand)]

http://www.ubuntu.com/usn/usn-617-1