smbd in Samba 3.0.6 through 3.0.23d allows remote authenticated users to cause a denial of service (memory and CPU exhaustion) by renaming a file in a way that prevents a request from being removed from the deferred open queue, which triggers an infinite loop.

From Red Hat Security Advisory 2007:0060 :

Updated samba packages that fix a denial of service vulnerability are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Samba provides file and printer sharing services to SMB/CIFS clients.

A denial of service flaw was found in Samba's smbd daemon process. An authenticated user could send a specially crafted request which would cause a smbd child process to enter an infinite loop condition. By opening multiple CIFS sessions, an attacker could exhaust system resources. (CVE-2007-0452)

Users of Samba should update to these packages, which contain a backported patch to correct this issue.

A logic error in the deferred open code can lead to an infinite loop in Samba's smbd daemon. (CVE-2007-0452)

In addition the following changes are included with these packages :

  - Move tdb utils to the client package.

  - The version string of binaries reported by the -V option     now include the package version control system version     number.

  - Fix time value reporting in libsmbclient; [#195285].

  - Store and restore NT hashes as string compatible values;
    [#185053].

  - Added winbindd null sid fix; [#185053].

  - Fix from Alison Winters of SGI to build even if     make_vscan is 0.

  - Send correct workstation name to prevent     NT_STATUS_INVALID_WORKSTATION beeing returned in     samlogon; [#148645], [#161051].

A flaw was discovered in Samba's file opening code, which in certain situations could lead to an endless loop, resulting in a denial of service. (CVE-2007-0452)

A format string overflow was discovered in Samba's ACL handling on AFS shares. Remote users with access to an AFS share could create crafted filenames and execute arbitrary code with root privileges.
(CVE-2007-0454).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A logic error in the deferred open code can lead to an infinite loop in Samba's smbd daemon (CVE-2007-0452).

In addition the following changes are included with these packages :

  - Move tdb utils to the client package.

  - Add version of the package subversion to Samba vendor     version suffix.

  - Fix time value reporting in libsmbclient; [#195285].

  - Store and restore NT hashes as string compatible values;
    [#185053].

  - Added winbindd null sid fix; [#185053].

  - Fix from Alison Winters of SGI to build even if     make_vscan is 0.

  - Send correct workstation name to prevent     NT_STATUS_INVALID_WORKSTATION beeing returned in     samlogon; [#148645], [#161051].

Updated samba packages that fix a denial of service vulnerability are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Samba provides file and printer sharing services to SMB/CIFS clients.

A denial of service flaw was found in Samba's smbd daemon process. An authenticated user could send a specially crafted request which would cause a smbd child process to enter an infinite loop condition. By opening multiple CIFS sessions, an attacker could exhaust system resources (CVE-2007-0452).

Users of Samba should update to these packages, which contain a backported patch to correct this issue.

The Samba Team reports :

Internally Samba's file server daemon, smbd, implements support for deferred file open calls in an attempt to serve client requests that would otherwise fail due to a share mode violation. When renaming a file under certain circumstances it is possible that the request is never removed from the deferred open queue. smbd will then become stuck is a loop trying to service the open request.

This bug may allow an authenticated user to exhaust resources such as memory and CPU on the server by opening multiple CIFS sessions, each of which will normally spawn a new smbd process, and sending each connection into an infinite loop.

According to its version number, the remote Samba server is affected by several flaws :

  - A denial of service issue occuring if an authenticated     attacker sends a large number of CIFS session requests     which will cause an infinite loop to occur in the smbd     daemon, thus utilizing CPU resources and denying access     to legitimate users ;

  - A remote format string vulnerability that could be     exploited by an attacker with write access to a remote     share by sending a malformed request to the remote     service (this issue only affects installations sharing     an AFS file system when the afsacl.so VFS module is     loaded)

  - A remote buffer overflow vulnerability affecting the NSS     lookup capability of the remote winbindd daemon

New samba packages are available for Slackware 10.0, 10.1, 10.2, and 11.0 to fix a denial-of-service security issue.

A logic error in the deferred open code for smbd may allow an authenticated user to exhaust resources such as memory and CPU on the server by opening multiple CIFS sessions, each of which will normally spawn a new smbd process, and sending each connection into an infinite loop. (CVE-2007-0452)

The name of a file on the server's share is used as the format string when setting an NT security descriptor through the afsacl.so VFS plugin. (CVE-2007-0454)

Updated packages have been patched to address these issues.

Updated samba packages that fix a denial of service vulnerability are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Samba provides file and printer sharing services to SMB/CIFS clients.

A denial of service flaw was found in Samba's smbd daemon process. An authenticated user could send a specially crafted request which would cause a smbd child process to enter an infinite loop condition. By opening multiple CIFS sessions, an attacker could exhaust system resources. (CVE-2007-0452)

Users of Samba should update to these packages, which contain a backported patch to correct this issue.

- Thu Nov 16 2006 Jay Fenlason <fenlason at redhat.com>     3.0.24-1.fc6

    - New upstream release

    - Update the -man patch to work with 3.0.24

    - This release fixes CVE-2007-0452 Samba smbd denial of       service

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Wed Feb 7 2007 Jay Fenlason <fenlason at redhat.com>     3.0.24-1.fc5

    - New upstream release

    - Update the -man patch to work with 3.0.24

    - This release fixes CVE-2007-0452 Samba smbd denial of       service

  - Tue Sep 26 2006 Jay Fenlason <fenlason at redhat.com>     3.0.23c-1.fc5

    - Include the newer smb.init that includes the       configtest option

    - Upgrade to 3.0.23c, obsoleting the -samr_alias patch.

    - Wed Aug 9 2006 Jay Fenlason <fenlason at redhat.com>       3.0.23b-1.fc5

    - New upstream release, fixing some annoying bugs.

    - Mon Jul 24 2006 Jay Fenlason <fenlason at redhat.com>       3.0.23a-1.fc5.1

    - Fix the -logfiles patch to close bz#199607 Samba       compiled with wrong log path. bz#199206 smb.conf has       incorrect log file path

  - Mon Jul 24 2006 Jay Fenlason <fenlason at redhat.com>     3.0.23a-1.fc5

    - Upgrade to new upstream 3.0.23a

    - include upstream samr_alias patch

    - Wed Jul 12 2006 Jay Fenlason <fenlason at redhat.com>       3.0.23-1.fc5

    - Upgrade to 3.0.23 to close bz#197836 CVE-2006-3403       Samba denial of service

  - include related spec file, filter-requires-samba.sh and     patch changes from rawhide.

  - include the fixed smb.init file from rawhide, closing     bz#182560 Wrong retval for initscript when smbd is dead

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several remote vulnerabilities have been discovered in samba, a free implementation of the SMB/CIFS protocol, which may lead to the execution of arbitrary code or denial of service. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-0452     It was discovered that incorrect handling of deferred     file open calls may lead to an infinite loop, which     results in denial of service.

  - CVE-2007-0454     'zybadawg333' discovered that the AFS ACL mapping VFS     plugin performs insecure format string handling, which     may lead to the execution of arbitrary code.

ID	Name	Product	Family	Severity
67446	Oracle Linux 3 / 4 : samba (ELSA-2007-0060)	Nessus	Oracle Linux Local Security Checks	medium
29575	SuSE 10 Security Update : samba (ZYPP Patch Number 2556)	Nessus	SuSE Local Security Checks	medium
28011	Ubuntu 5.10 / 6.06 LTS / 6.10 : samba vulnerabilities (USN-419-1)	Nessus	Ubuntu Local Security Checks	high
27427	openSUSE 10 Security Update : samba (samba-2553)	Nessus	SuSE Local Security Checks	medium
25314	RHEL 5 : samba (RHSA-2007:0061)	Nessus	Red Hat Local Security Checks	medium
24826	FreeBSD : samba -- potential Denial of Service bug in smbd (f235fe7a-b9ca-11db-bf0f-0013720b182d)	Nessus	FreeBSD Local Security Checks	medium
24685	Samba < 3.0.24 Multiple Flaws	Nessus	Misc.	high
24668	Slackware 10.0 / 10.1 / 10.2 / 11.0 : samba (SSA:2007-038-01)	Nessus	Slackware Local Security Checks	high
24647	Mandrake Linux Security Advisory : samba (MDKSA-2007:034)	Nessus	Mandriva Local Security Checks	high
24364	RHEL 3 / 4 : samba (RHSA-2007:0060)	Nessus	Red Hat Local Security Checks	medium
24358	CentOS 3 / 4 : samba (CESA-2007:0060)	Nessus	CentOS Local Security Checks	medium
24306	Fedora Core 6 : samba-3.0.24-1.fc6 (2007-220)	Nessus	Fedora Local Security Checks	medium
24305	Fedora Core 5 : samba-3.0.24-1.fc5 (2007-219)	Nessus	Fedora Local Security Checks	medium
24296	Debian DSA-1257-1 : samba - several vulnerabilities	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2007-0452

medium

Tenable Plugins

medium

medium

high

medium

medium

medium

high

high

high

medium

medium

medium

medium

high