Buffer overflow in samba 2.2.2 through 2.2.6 allows remote attackers to cause a denial of service and possibly execute arbitrary code via an encrypted password that causes the overflow during decryption in which a DOS codepage string is converted to a little-endian UCS2 unicode string.

Steve Langasek found an exploitable bug in the password handling code in samba: when converting from DOS code-page to little endian UCS2 unicode a buffer length was not checked and a buffer could be overflowed. There is no known exploit for this, but an upgrade is strongly recommended.

The remote Samba server is vulnerable to a buffer overflow when a client requests a password change. An attacker may use it to cause a denial of service or execute arbitrary code on this host with root privileges 

A vulnerability in samba versions 2.2.2 through 2.2.6 was discovered by the Debian samba maintainers. A bug in the length checking for encrypted password change requests from clients could be exploited using a buffer overrun attack on the smbd stack. This attack would have to crafted in such a way that converting a DOS codepage string to little endian UCS2 unicode would translate into an executable block of code.

This vulnerability has been fixed in samba version 2.2.7, and the updated packages have had a patch applied to fix the problem.

The remote Samba server, according to its version number, is vulnerable to a bug in the length checking for encrypted password change requests from clients. A client could potentially send an encrypted password, which, when decrypted with the old hashed password could be used as a buffer overrun attack on the stack of smbd.

ID	Name	Product	Family	Severity
15037	Debian DSA-200-1 : samba - remote exploit	Nessus	Debian Local Security Checks	critical
1343	Samba < 2.2.7 Unicode Encrypted Password Decryption Overflow	Nessus Network Monitor	Samba	critical
13979	Mandrake Linux Security Advisory : samba (MDKSA-2002:081)	Nessus	Mandriva Local Security Checks	critical
11168	Samba Encrypted Password String Conversion Decryption Overflow	Nessus	Gain a shell remotely	critical

Detections

Analytics

CVE-2002-1318

critical

Tenable Plugins

critical

critical

critical

critical