Logic error in the SID/Name translation functionality in smbd in Samba 3.0.23d through 3.0.25pre2 allows local users to gain temporary privileges and execute SMB/CIFS protocol operations via unspecified vectors that cause the daemon to transition to the root user.

USN-460-1 fixed several vulnerabilities in Samba. The upstream changes for CVE-2007-2444 had an unexpected side-effect in Feisty. Shares configured with the 'force group' option no longer behaved correctly.
This update corrects the problem. We apologize for the inconvenience.

Paul Griffith and Andrew Hogue discovered that Samba did not fully drop root privileges while translating SIDs. A remote authenticated user could issue SMB operations during a small window of opportunity and gain root privileges. (CVE-2007-2444).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Paul Griffith and Andrew Hogue discovered that Samba did not fully drop root privileges while translating SIDs. A remote authenticated user could issue SMB operations during a small window of opportunity and gain root privileges. (CVE-2007-2444)

Brian Schafer discovered that Samba did not handle NDR parsing correctly. A remote attacker could send specially crafted MS-RPC requests that could overwrite heap memory and execute arbitrary code.
(CVE-2007-2446)

It was discovered that Samba did not correctly escape input parameters for external scripts defined in smb.conf. Remote authenticated users could send specially crafted MS-RPC requests and execute arbitrary shell commands. (CVE-2007-2447).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Specially crafted MS-RPC packets could overwrite heap memory and therfore could potentially be exploited to execute code (CVE-2007-2446).

Authenticated users could leverage specially crafted MS-RPC packets to pass arguments unfiltered to /bin/sh (CVE-2007-2447).

A bug in the local SID/Name translation routines may potentially result in a user being able to issue SMB protocol operations as root (CVE-2007-2444).

The Samba Team reports :

A bug in the local SID/Name translation routines may potentially result in a user being able to issue SMB/CIFS protocol operations as root.

When translating SIDs to/from names using Samba local list of user and group accounts, a logic error in the smbd daemon's internal security stack may result in a transition to the root user id rather than the non-root user. The user is then able to temporarily issue SMB/CIFS protocol operations as the root user. This window of opportunity may allow the attacker to establish additional means of gaining root access to the server.

Various bugs in Samba's NDR parsing can allow a user to send specially crafted MS-RPC requests that will overwrite the heap space with user defined data.

Unescaped user input parameters are passed as arguments to /bin/sh allowing for remote command execution.

This bug was originally reported against the anonymous calls to the SamrChangePassword() MS-RPC function in combination with the 'username map script' smb.conf option (which is not enabled by default).

After further investigation by Samba developers, it was determined that the problem was much broader and impacts remote printer and file share management as well. The root cause is passing unfiltered user input provided via MS-RPC calls to /bin/sh when invoking externals scripts defined in smb.conf. However, unlike the 'username map script' vulnerability, the remote file and printer management scripts require an authenticated user session.

According to its banner, the version of the Samba server installed on the remote host is affected by multiple buffer overflow and remote command injection vulnerabilities that can be exploited remotely, as well as a local privilege escalation bug. 

A number of bugs were discovered in the NDR parsing support in Samba that is used to decode MS-RPC requests. A remote attacker could send a carefully crafted request that would cause a heap overflow, possibly leading to the ability to execute arbitrary code on the server (CVE-2007-2446).

A remote authenticated user could trigger a flaw where unescaped user input parameters were being passed as arguments to /bin/sh (CVE-2007-2447).

Finally, on Samba 3.0.23d and higher, when Samba translated SID to/from name using the Samba local list of user and group accounts, a logic error in smbd's internal security stack could result in a transition to the root user id rather than the non-root user (CVE-2007-2444).

Update :

The fix for CVE-2007-2444 broke the behaviour of force group when the forced group is a local Unix group for domain member servers.

This update corrects that regression.

The remote host is affected by the vulnerability described in GLSA-200705-15 (Samba: Multiple vulnerabilities)

    Samba contains a logical error in the smbd daemon when translating     local SID to user names (CVE-2007-2444). Furthermore, Samba contains     several bugs when parsing NDR encoded RPC parameters (CVE-2007-2446).
    Lastly, Samba fails to properly sanitize remote procedure input     provided via Microsoft Remote Procedure Calls (CVE-2007-2447).
  Impact :

    A remote attacker could exploit these vulnerabilities to gain root     privileges via various vectors.
  Workaround :

    There is no known workaround at this time.

This release of Samba fixes some Serious security bugs :

  - CVE-2007-2444

    - CVE-2007-2446

    - CVE-2007-2447

Official upstream announcements here:
http://www.samba.org/samba/security/CVE-2007-2444.html http://www.samba.org/samba/security/CVE-2007-2446.html http://www.samba.org/samba/security/CVE-2007-2447.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several issues have been identified in Samba, the SMB/CIFS file- and print-server implementation for GNU/Linux.

  - CVE-2007-2444     When translating SIDs to/from names using Samba local     list of user and group accounts, a logic error in the     smbd daemon's internal security stack may result in a     transition to the root user id rather than the non-root     user. The user is then able to temporarily issue     SMB/CIFS protocol operations as the root user. This     window of opportunity may allow the attacker to     establish addition means of gaining root access to the     server.

  - CVE-2007-2446     Various bugs in Samba's NDR parsing can allow a user to     send specially crafted MS-RPC requests that will     overwrite the heap space with user defined data.

  - CVE-2007-2447     Unescaped user input parameters are passed as arguments     to /bin/sh allowing for remote command execution.

New samba packages are available for Slackware 10.0, 10.1, 10.2, 11.0, and -current to fix security issues.

According to its banner, the version of the Samba server installed on the remote host is affected by multiple buffer overflow and remote command injection vulnerabilities, which can be exploited remotely, as well as a local privilege escalation bug.

ID	Name	Product	Family	Severity
28060	Ubuntu 7.04 : samba regression (USN-460-2)	Nessus	Ubuntu Local Security Checks	high
28059	Ubuntu 6.06 LTS / 6.10 / 7.04 : samba vulnerabilities (USN-460-1)	Nessus	Ubuntu Local Security Checks	critical
27430	openSUSE 10 Security Update : samba (samba-3350)	Nessus	SuSE Local Security Checks	critical
25260	FreeBSD : samba -- multiple vulnerabilities (3546a833-03ea-11dc-a51d-0019b95d4f14)	Nessus	FreeBSD Local Security Checks	critical
3990	Samba < 3.0.25 Multiple Vulnerabilities	Nessus Network Monitor	Samba	high
25237	Mandrake Linux Security Advisory : samba (MDKSA-2007:104-1)	Nessus	Mandriva Local Security Checks	critical
25236	GLSA-200705-15 : Samba: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
25234	Fedora Core 6 : samba-3.0.24-5.fc6 (2007-507)	Nessus	Fedora Local Security Checks	high
25233	Fedora Core 5 : samba-3.0.24-5.fc5 (2007-506)	Nessus	Fedora Local Security Checks	high
25228	Debian DSA-1291-1 : samba - several vulnerabilities	Nessus	Debian Local Security Checks	critical
25222	Slackware 10.0 / 10.1 / 10.2 / 11.0 / current : samba (SSA:2007-134-01)	Nessus	Slackware Local Security Checks	critical
25217	Samba < 3.0.25 Multiple Vulnerabilities	Nessus	Misc.	critical

Detections

Analytics

CVE-2007-2444

high

Tenable Plugins

high

critical

critical

critical

high

critical

critical

high

high

critical

critical

critical