Memory leak in smbd in Samba 3.6.x before 3.6.3 allows remote attackers to cause a denial of service (memory and CPU consumption) by making many connection requests.

The remote NewStart CGSL host, running version MAIN 6.02, has samba packages installed that are affected by multiple vulnerabilities:

  - Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow     remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum     (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount     (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2     (lsa_io_trans_names). (CVE-2007-2446)

  - The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute     arbitrary commands via shell metacharacters involving the (1) SamrChangePassword function, when the     username map script smb.conf option is enabled, and allows remote authenticated users to execute     commands via shell metacharacters involving other MS-RPC functions in the (2) remote printer and (3) file     share management. (CVE-2007-2447)

  - Heap-based buffer overflow in the receive_smb_raw function in util/sock.c in Samba 3.0.0 through 3.0.29     allows remote attackers to execute arbitrary code via a crafted SMB response. (CVE-2008-1105)

  - Samba 3.4 before 3.4.2, 3.3 before 3.3.8, 3.2 before 3.2.15, and 3.0.12 through 3.0.36, as used in the SMB     subsystem in Apple Mac OS X 10.5.8 when Windows File Sharing is enabled, Fedora 11, and other operating     systems, does not properly handle errors in resolving pathnames, which allows remote authenticated users     to bypass intended sharing restrictions, and read, create, or modify files, in certain circumstances     involving user accounts that lack home directories. (CVE-2009-2813)

  - smbd in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8, and 3.4 before 3.4.2 allows remote     authenticated users to cause a denial of service (infinite loop) via an unanticipated oplock break     notification reply packet. (CVE-2009-2906)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- Fix memory leak in parent smbd on connection;
    CVE-2012-0817; (bso#8724); (bnc#743986).

  - Use spdx.org compliant license names for all packages.

  - Update to 3.6.2.

See WHATSNEW.txt from the main tar ball or the samba.changes file for more details.

  - s3-spoolss: Pass the right pointer type; (bso#4942);
    (bnc#742504).

  - Use correct license, LGPLv3+ for libwbclient packages.

  - When returning an ACL without SECINFO_DACL requested, we     still set SEC_DESC_DACL_PRESENT in the type field;
    (bso#8636).

  - Prefix print$ path on driver file deletion; (bso#8697);
    (bnc#740810).

  - Fix printer_driver_files_in_use() call ordering;
    (bso#4942); (bnc#742504).

  - Buffer overflow issue with AES encryption in samba     traffic analyzer; (bso#8674).

  - NT ACL issue; (bso#8673).

  - Deleting a symlink fails if the symlink target is     outside of the share; (bso#8663).

  - connections.tdb - major leak with SMB2; (bso#8710).

  - Renaming a symlink fails if the symlink target is     outside of the share; (bso#8664).

  - Intermittent print job failures caused by character     conversion errors; (bso#8606).

  - ads_keytab_verify_ticket mixes talloc allocation with     malloc free; (bso#8692).

  - libcli/cldap: fix a crash bug in     cldap_socket_recv_dgram(); (bso#8593).

  - s3:lib/ctdbd_conn: try ctdbd_init_connection() as root;
    (bso#8684).

  - s3-printing: fix migrate printer code; (bso#8618).

  - Packet validation checks can be done before length     validation causing uninitialized memory read;
    (bso#8686).

  - net memberships usage info was wrong; (bso#8687).

  - s3-libsmb: Don't duplicate kerberos service tickets;
    (bso#8628).

  - Recvfile code path using splice() on Linux leaves data     in the pipe on short write; (bso#8679).

  - s3-winbind: Fix segfault if we can't map the last user;
    (bso#8678).

  - vfs_acl_xattr and vfs_acl_tdb modules can fail to add     inheritable entries on a directory with no stored ACL;
    (bso#8644).

  - s3/doc: document the ignore system acls option of     vfs_acl_xattr and vfs_acl_tdb; (bso#8652).

  - Winbind can't receive any user/group information;
    (bso#8371).

  - s3-winbind: Add an update function for winbind cache;
    (bso#8643).

  - s3: Attempt to fix the vfs_commit module.

  - POSIX ACE x permission becomes rx following mapping to     and from a DACL; (#bso#8631).

  - s3:libsmb: only align unicode pipe_name; (bso#8586).

  - s3-winbind: Don't fail on users without a uid;
    (bso#8608).

  - Crash when trying to browse samba printers; (bso#8623).

  - talloc: double free error; (bso#8562).

  - cldap doesn't work over ipv6; (bso#8600).

  - s3:libsmb: fix cli_write_and_x() against OS/2 print     shares; (bso#5326).

  - SMB2: not granting credits for all requests in a     compound request; (bso#8614).

  - smb2_flush sends uninitialized memory; (bso#8579).

  - Password change settings not fully observed; (bso#8561).

  - s3:smb2_server: grant credits in async interim     responses; (bso#8357).

  - s3:smbd: don't limit the number of open dptrs for smb2;
    (bso#8592).

  - samr_ChangePasswordUser3 IDL incorrect; (bso#8591).

  - idmap_autorid does not have allocation pool; (bso#8444).

  - Add systemd service files.

  - s3:libsmb: the workgroup in the non-extended-security     negprot is not aligned; (bso#8573).

  - s3-build: Fix inotify detection; (bso#8580).

  - SMB2 doesn't handle compound request headers in the same     way as Windows; (#bso8560).

  - Disconnecting clients swamp the logs; (bso#8585).

  - s3-netlogon: Fix setting the machinge account password;
    (bso#8550).

  - winbind_samlogon_retry_loop ignores logon_parameters     flags; (#bso8548). 

  - smbclient posix_open command fails to return correct     info on open file; (bso#8542).

  - readlink() on Linux clients fails if the symlink target     is outside of the share; (bso#8541).

  - s3-netapi: remove pointless use_memory_krb5_ccache;
    (bso#7465).

  - s3:Makefile: make DSO_EXPORTS_CMD more portable;
    (bso#8531).

  - s3:registry: fix the test for a REG_SZ blob possibly     being a zero terminated ucs2 string; (bso#8528).

  - Make VFS op 'streaminfo' stackable; (bso#8419).

  - Fix incorrect perfcount array length calculations;
    (bnc#739258).

  - BuildRequire autoconf to avoid implicit dependency for     post-11.4 systems.

  - Remove call to suse_update_config macro for post-11.4     systems.

  - Use samba.org for the ldapsmb source location.

  - Fixing libsmbsharemode dependency on ldap and krb5 libs     in Makefile; (bnc #729516).

  - Add ldap to Should-Start and Stop of the smb init     script; (bnc#730046).

  - Fix smbd srv_spoolss_replycloseprinter() segfault;
    (bso#8384); (bnc#731571).

  - Fix pam_winbind.so segfault in pam_sm_authenticate();
    (bso#8564).

  - Fix smbclient >8GB tars on big endian machines;
    (bso#563); (bnc#726145).

  - Fix typo in net ads join output; (bnc#713135).

  - Add 'ldapsam:login cache' parameter to allow explicit     disabling of the login cache; (bnc#723261).

  - Fix samba duplicates file content on appending. Move     posix case semantics out from under the VFS; (bso#6898);
    (bnc#681208).

  - Make winbind child reconnect when remote end has closed,     fix failing sudo; (bso#7295); (bnc#569721).

  - Fix printing from Windows 7 clients; (bso#7567);
    (bnc#687535).

  - Update pidl and always compile IDL at build time;
    (bnc#688810).

  - Abide by print$ share 'force user' & 'force group'     settings when handling AddprinterDriver and     DeletePrinterDriver requests; (bso#7921); (bnc#653353).

The following issues have been fixed in Samba :

  - PIDL based autogenerated code uses client supplied size     values which allows attackers to write beyond the     allocated array size. (CVE-2012-1182)

  - Ensure AndX offsets are increasing strictly     monotonically in pre-3.4 versions. (CVE-2012-0870)

  - Fix memory leak in parent smbd on connection Also the     following non-security bugs have been fixed :.
    (CVE-2012-0817)

  - s3-winbindd: Only use SamLogonEx when we can get     unencrypted session keys; (bso#8599).

  - Correctly handle DENY ACEs when privileges apply;
    (bso#8797).

  - s3:smb2_server: fix a logic error, we should sign non     guest sessions; (bso8749).

  - Allow vfs_aio_pthread to build as a static module;
    (bso#8723).

  - s3:dbwrap_ctdb: return the number of records in     db_ctdb_traverse() for persistent dbs; (#bso8527).

  - s3: segfault in dom_sid_compare(bso#8567).

  - Honor SeTakeOwnershiPrivilege when client asks for     SEC_STD_WRITE_OWNER; (bso#8768).

  - s3-winbindd: Close netlogon connection if the status     returned by the NetrSamLogonEx call is timeout in the     pam_auth_crap path; (bso#8771).

  - s3-winbindd: set the can_do_validation6 also for trusted     domain; (bso#8599).

  - Fix problem when calculating the share security mask,     take priviliges into account for the connecting user;
    (bso#8784).

  - Fix crash in dcerpc_lsa_lookup_sids_noalloc() with over     1000 groups; (bso#8807);. (bnc#751454)

  - Add SERVERID_UNIQUE_ID_NOT_TO_VERIFY; (bso#8760);.
    (bnc#741854)

  - s3-printing: fix crash in printer_list_set_printer();
    (bso#8762);. (bnc#746825)

  - s3:winbindd fix a return code check; (bso#8406).

  - s3: Add rmdir operation to streams_depot; (bso#8733).

  - s3:smbd:smb2: fix an assignment-instead-of-check bug     conn_snum_used(); (bso#8738).

  - s3:auth: fill the sids array of the info3 in     wbcAuthUserInfo_to_netr_SamInfo3(); (bso#8739).

  - Do not map POSIX execute permission to Windows     FILE_READ_ATTRIBUTES; (bso#8631);. (bnc#732572)

  - Remove all precompiled idl output to ensure any pidl     changes take effect;. (bnc#757080)

This is a security release in order to address CVE-2012-0817 (Memory leak/Denial of service).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of Samba 3.6.x running on the remote host is earlier than 3.6.3.  Errors exist in the files 'source3/lib/substitute.c' and 'source3/smbd/server.c' that leak small amounts of memory when processing every connection attempt.

An attacker can continually make connections to the server and cause a denial of service attack against the affected smbd service.

According to its banner, the version of Samba 3.6.x running on the remote host is earlier than 3.6.3. Errors exist in the files 'source3/lib/substitute.c' and 'sources3/smbd/server.c' that leak small amounts of memory when processing every connection attempt.

An attacker can continually make connections to the server and cause a denial of service attack against the affected smbd service.

Note that Nessus has not actually tried to exploit this issue or otherwise determine if the patch has been applied.

ID	Name	Product	Family	Severity
206855	NewStart CGSL MAIN 6.02 : samba Multiple Vulnerabilities (NS-SA-2024-0054)	Nessus	NewStart CGSL Local Security Checks	critical
74545	openSUSE Security Update : samba (openSUSE-2012-109)	Nessus	SuSE Local Security Checks	medium
58767	SuSE 11.2 Security Update : Samba (SAT Patch Number 6145)	Nessus	SuSE Local Security Checks	critical
57868	Fedora 16 : samba-3.6.3-78.fc16 (2012-1098)	Nessus	Fedora Local Security Checks	medium
6299	Samba 3.6.x < 3.6.3 Denial of Service	Nessus Network Monitor	Samba	medium
57752	Samba 3.6.x < 3.6.3 Denial of Service	Nessus	Misc.	medium

Detections

Analytics

CVE-2012-0817

high

Tenable Plugins

critical

medium

critical

medium

medium

medium