According to its banner, the version of Samba 3.6.x running on the remote host is earlier than 3.6.3. Errors exist in the files 'source3/lib/substitute.c' and 'sources3/smbd/server.c' that leak small amounts of memory when processing every connection attempt.

An attacker can continually make connections to the server and cause a denial of service attack against the affected smbd service.

Note that Nessus has not actually tried to exploit this issue or otherwise determine if the patch has been applied.

- Fix memory leak in parent smbd on connection;
    CVE-2012-0817; (bso#8724); (bnc#743986).

  - Use spdx.org compliant license names for all packages.

  - Update to 3.6.2.

See WHATSNEW.txt from the main tar ball or the samba.changes file for more details.

  - s3-spoolss: Pass the right pointer type; (bso#4942);
    (bnc#742504).

  - Use correct license, LGPLv3+ for libwbclient packages.

  - When returning an ACL without SECINFO_DACL requested, we     still set SEC_DESC_DACL_PRESENT in the type field;
    (bso#8636).

  - Prefix print$ path on driver file deletion; (bso#8697);
    (bnc#740810).

  - Fix printer_driver_files_in_use() call ordering;
    (bso#4942); (bnc#742504).

  - Buffer overflow issue with AES encryption in samba     traffic analyzer; (bso#8674).

  - NT ACL issue; (bso#8673).

  - Deleting a symlink fails if the symlink target is     outside of the share; (bso#8663).

  - connections.tdb - major leak with SMB2; (bso#8710).

  - Renaming a symlink fails if the symlink target is     outside of the share; (bso#8664).

  - Intermittent print job failures caused by character     conversion errors; (bso#8606).

  - ads_keytab_verify_ticket mixes talloc allocation with     malloc free; (bso#8692).

  - libcli/cldap: fix a crash bug in     cldap_socket_recv_dgram(); (bso#8593).

  - s3:lib/ctdbd_conn: try ctdbd_init_connection() as root;
    (bso#8684).

  - s3-printing: fix migrate printer code; (bso#8618).

  - Packet validation checks can be done before length     validation causing uninitialized memory read;
    (bso#8686).

  - net memberships usage info was wrong; (bso#8687).

  - s3-libsmb: Don't duplicate kerberos service tickets;
    (bso#8628).

  - Recvfile code path using splice() on Linux leaves data     in the pipe on short write; (bso#8679).

  - s3-winbind: Fix segfault if we can't map the last user;
    (bso#8678).

  - vfs_acl_xattr and vfs_acl_tdb modules can fail to add     inheritable entries on a directory with no stored ACL;
    (bso#8644).

  - s3/doc: document the ignore system acls option of     vfs_acl_xattr and vfs_acl_tdb; (bso#8652).

  - Winbind can't receive any user/group information;
    (bso#8371).

  - s3-winbind: Add an update function for winbind cache;
    (bso#8643).

  - s3: Attempt to fix the vfs_commit module.

  - POSIX ACE x permission becomes rx following mapping to     and from a DACL; (#bso#8631).

  - s3:libsmb: only align unicode pipe_name; (bso#8586).

  - s3-winbind: Don't fail on users without a uid;
    (bso#8608).

  - Crash when trying to browse samba printers; (bso#8623).

  - talloc: double free error; (bso#8562).

  - cldap doesn't work over ipv6; (bso#8600).

  - s3:libsmb: fix cli_write_and_x() against OS/2 print     shares; (bso#5326).

  - SMB2: not granting credits for all requests in a     compound request; (bso#8614).

  - smb2_flush sends uninitialized memory; (bso#8579).

  - Password change settings not fully observed; (bso#8561).

  - s3:smb2_server: grant credits in async interim     responses; (bso#8357).

  - s3:smbd: don't limit the number of open dptrs for smb2;
    (bso#8592).

  - samr_ChangePasswordUser3 IDL incorrect; (bso#8591).

  - idmap_autorid does not have allocation pool; (bso#8444).

  - Add systemd service files.

  - s3:libsmb: the workgroup in the non-extended-security     negprot is not aligned; (bso#8573).

  - s3-build: Fix inotify detection; (bso#8580).

  - SMB2 doesn't handle compound request headers in the same     way as Windows; (#bso8560).

  - Disconnecting clients swamp the logs; (bso#8585).

  - s3-netlogon: Fix setting the machinge account password;
    (bso#8550).

  - winbind_samlogon_retry_loop ignores logon_parameters     flags; (#bso8548). 

  - smbclient posix_open command fails to return correct     info on open file; (bso#8542).

  - readlink() on Linux clients fails if the symlink target     is outside of the share; (bso#8541).

  - s3-netapi: remove pointless use_memory_krb5_ccache;
    (bso#7465).

  - s3:Makefile: make DSO_EXPORTS_CMD more portable;
    (bso#8531).

  - s3:registry: fix the test for a REG_SZ blob possibly     being a zero terminated ucs2 string; (bso#8528).

  - Make VFS op 'streaminfo' stackable; (bso#8419).

  - Fix incorrect perfcount array length calculations;
    (bnc#739258).

  - BuildRequire autoconf to avoid implicit dependency for     post-11.4 systems.

  - Remove call to suse_update_config macro for post-11.4     systems.

  - Use samba.org for the ldapsmb source location.

  - Fixing libsmbsharemode dependency on ldap and krb5 libs     in Makefile; (bnc #729516).

  - Add ldap to Should-Start and Stop of the smb init     script; (bnc#730046).

  - Fix smbd srv_spoolss_replycloseprinter() segfault;
    (bso#8384); (bnc#731571).

  - Fix pam_winbind.so segfault in pam_sm_authenticate();
    (bso#8564).

  - Fix smbclient >8GB tars on big endian machines;
    (bso#563); (bnc#726145).

  - Fix typo in net ads join output; (bnc#713135).

  - Add 'ldapsam:login cache' parameter to allow explicit     disabling of the login cache; (bnc#723261).

  - Fix samba duplicates file content on appending. Move     posix case semantics out from under the VFS; (bso#6898);
    (bnc#681208).

  - Make winbind child reconnect when remote end has closed,     fix failing sudo; (bso#7295); (bnc#569721).

  - Fix printing from Windows 7 clients; (bso#7567);
    (bnc#687535).

  - Update pidl and always compile IDL at build time;
    (bnc#688810).

  - Abide by print$ share 'force user' & 'force group'     settings when handling AddprinterDriver and     DeletePrinterDriver requests; (bso#7921); (bnc#653353).

This is a security release in order to address CVE-2012-0817 (Memory leak/Denial of service).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The following issues have been fixed in Samba :

  - PIDL based autogenerated code uses client supplied size     values which allows attackers to write beyond the     allocated array size. (CVE-2012-1182)

  - Ensure AndX offsets are increasing strictly     monotonically in pre-3.4 versions. (CVE-2012-0870)

  - Fix memory leak in parent smbd on connection Also the     following non-security bugs have been fixed :.
    (CVE-2012-0817)

  - s3-winbindd: Only use SamLogonEx when we can get     unencrypted session keys; (bso#8599).

  - Correctly handle DENY ACEs when privileges apply;
    (bso#8797).

  - s3:smb2_server: fix a logic error, we should sign non     guest sessions; (bso8749).

  - Allow vfs_aio_pthread to build as a static module;
    (bso#8723).

  - s3:dbwrap_ctdb: return the number of records in     db_ctdb_traverse() for persistent dbs; (#bso8527).

  - s3: segfault in dom_sid_compare(bso#8567).

  - Honor SeTakeOwnershiPrivilege when client asks for     SEC_STD_WRITE_OWNER; (bso#8768).

  - s3-winbindd: Close netlogon connection if the status     returned by the NetrSamLogonEx call is timeout in the     pam_auth_crap path; (bso#8771).

  - s3-winbindd: set the can_do_validation6 also for trusted     domain; (bso#8599).

  - Fix problem when calculating the share security mask,     take priviliges into account for the connecting user;
    (bso#8784).

  - Fix crash in dcerpc_lsa_lookup_sids_noalloc() with over     1000 groups; (bso#8807);. (bnc#751454)

  - Add SERVERID_UNIQUE_ID_NOT_TO_VERIFY; (bso#8760);.
    (bnc#741854)

  - s3-printing: fix crash in printer_list_set_printer();
    (bso#8762);. (bnc#746825)

  - s3:winbindd fix a return code check; (bso#8406).

  - s3: Add rmdir operation to streams_depot; (bso#8733).

  - s3:smbd:smb2: fix an assignment-instead-of-check bug     conn_snum_used(); (bso#8738).

  - s3:auth: fill the sids array of the info3 in     wbcAuthUserInfo_to_netr_SamInfo3(); (bso#8739).

  - Do not map POSIX execute permission to Windows     FILE_READ_ATTRIBUTES; (bso#8631);. (bnc#732572)

  - Remove all precompiled idl output to ensure any pidl     changes take effect;. (bnc#757080)

According to its banner, the version of Samba 3.6.x running on the remote host is earlier than 3.6.3.  Errors exist in the files 'source3/lib/substitute.c' and 'source3/smbd/server.c' that leak small amounts of memory when processing every connection attempt.

An attacker can continually make connections to the server and cause a denial of service attack against the affected smbd service.

ID	Name	Product	Family	Published	Updated	Severity
57752	Samba 3.6.x < 3.6.3 Denial of Service	Nessus	Misc.	1/31/2012	11/15/2018	medium
74545	openSUSE Security Update : samba (openSUSE-2012-109)	Nessus	SuSE Local Security Checks	6/13/2014	1/19/2021	medium
57868	Fedora 16 : samba-3.6.3-78.fc16 (2012-1098)	Nessus	Fedora Local Security Checks	2/9/2012	1/11/2021	medium
58767	SuSE 11.2 Security Update : Samba (SAT Patch Number 6145)	Nessus	SuSE Local Security Checks	4/17/2012	1/19/2021	critical
6299	Samba 3.6.x < 3.6.3 Denial of Service	Nessus Network Monitor	Samba	2/1/2012	3/6/2019	medium

Detections

Analytics

Plugins Search

medium

medium

medium

critical

medium