Comment 2 for bug 11243

Message-Id: <email address hidden>
Date: Fri, 17 Dec 2004 01:08:02 +0100
From: Ulf Theobald <email address hidden>
To: Debian Bug Tracking System <email address hidden>
Subject: samba: Integer overflow could lead to remote code execution in Samba

Package: samba
Severity: critical
Tags: security
Justification: root security hole

===========
Description
===========

Remote exploitation of an integer overflow vulnerability
in the smbd daemon included in Samba 2.0.x, Samba 2.2.x,
and Samba 3.0.x prior to and including 3.0.9 could
allow an attacker to cause controllable heap corruption,
leading to execution of arbitrary commands with root
privileges.

Successful remote exploitation allows an attacker to
gain root privileges on a vulnerable system. In order
to exploit this vulnerability an attacker must possess
credentials that allow access to a share on the Samba server.
Unsuccessful exploitation attempts will cause the process
serving the request to crash with signal 11, and may leave
evidence of an attack in logs.

==================
Patch Availability
==================

A patch for Samba 3.0.9 (samba-3.0.9-CAN-2004-1154.patch)
can be downloaded from

    http://www.samba.org/samba/ftp/patches/security/

    The patch has been signed with the "Samba Distribution
    Verification Key" (ID F17F9772).