-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
A  U  S  C  E  R  T                                           A  L  E  R  T

                       AL-2007.0065 -- AUSCERT ALERT
                               [UNIX/Linux]
Samba vulnerabilities: Multiple Heap Overflows and Remote Command Injection
                                15 May 2007

===========================================================================

        AusCERT Alert Summary
        ---------------------

Product:              Samba 3.0.0 - 3.0.25rc3 (inclusive)
Publisher:            Samba
Operating System:     UNIX variants (UNIX, Linux, OSX)
Impact:               Execute Arbitrary Code/Commands
Access:               Remote/Unauthenticated
CVE Names:            CVE-2007-2446 CVE-2007-2447

Original Bulletin:   
  http://www.samba.org/samba/security/CVE-2007-2446.htm
  http://www.samba.org/samba/security/CVE-2007-2447.htm

Comment: This alert contains two Samba advisories.

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

==========================================================
==
== Subject:     Multiple Heap Overflows Allow Remote
==              Code Execution
== CVE ID#:     CVE-2007-2446
==
== Versions:    Samba 3.0.0 - 3.0.25rc3 (inclusive)
==
== Summary:     Various bugs in Samba's NDR parsing
==              can allow a user to send specially
==              crafted MS-RPC requests that will
==              overwrite the heap space with user
==              defined data.
==
==========================================================

===========
Description
===========

Various bugs in Samba's NDR parsing can allow a user
to send specially crafted MS-RPC requests that will
overwrite the heap space with user defined data.


==================
Patch Availability
==================

A patch against Samba 3.0.24 has been posted at

  http://www.samba.org/samba/security/


==========
Workaround
==========

There is no immediate workaround for this defect that does
not involve changing the server code in the smbd daemon.
The Samba Team always encourages users to run the latest
stable release as a defense against attacks.  If this
is not immediately possible, administrators should read
the "Server Security" documentation found at

  http://www.samba.org/samba/docs/server_security.html


=======
Credits
=======

This vulnerability was reported to Samba developers by Brian
Schafer, TippingPoint Security Response Lead, as part
of the Zero Day Initiative (http://www.zerodayinitiative.com).

The time line is as follows:

* April 25, 2007: Four individual defects reported to the
  security@samba.org email alias.
* April 25, 2007: Initial developer response by Samba
  developer Volker Lendecke.
* April 28, 2007: Patches for four defects released by
  Samba developer Jeremy Allison to ZDI for testing.
* May 3, 2007: Fixed confirmed by original reporter.
* May 5, 2007: Fifth defect reported to security@samba.org.
* May 5, 2007: Patches for fifth defects released to ZDI
  for testing by Samba developer Jeremy Allison.
* May 10, Announcement to vendor-sec mailing list
* May 14, 2007: Public announcement of the security issue.



==========================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
==========================================================

- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFGR5XYIR7qMdg1EfYRAt3rAJ9fF3obUfyUBxr46Qx7RJSY+aDCzACgivcK
oBThjTk/tZkqjRMuVYSiT8g=
=Qzo8
- -----END PGP SIGNATURE-----



- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

==========================================================
==
== Subject:     Remote Command Injection Vulnerability
== CVE ID#:     CVE-2007-2447
==
== Versions:    Samba 3.0.0 - 3.0.25rc3 (inclusive)
==
== Summary:	Unescaped user input parameters are passed
==              as arguments to /bin/sh allowing for remote
==              command execution
==
==========================================================

===========
Description
===========

This bug was originally reported against the anonymous calls
to the SamrChangePassword() MS-RPC function in combination
with the "username map script" smb.conf option (which is not
enabled by default).

After further investigation by Samba developers, it was
determined that the problem was much broader and impacts
remote printer and file share management as well.  The root
cause is passing unfiltered user input provided via MS-RPC
calls to /bin/sh when invoking externals scripts defined
in smb.conf.  However, unlike the "username map script"
vulnerability, the remote file and printer management scripts
require an authenticated user session.


==================
Patch Availability
==================

A patch against Samba 3.0.24 has been posted at

  http://www.samba.org/samba/security/


==========
Workaround
==========

This defect may be alleviated by removing all defined
external script invocations (username map script, add
printer command, etc...) from smb.conf.

The Samba Team always encourages users to run the latest
stable release as a defense against attacks.  If this
is not immediately possible, administrators should read
the "Server Security" documentation found at

  http://www.samba.org/samba/docs/server_security.html


=======
Credits
=======

This vulnerability was  discovered by an anonymous researcher
and reported to Samba developers by Joshua J. Drake, iDefense
Labs (http://www.idefense.com/), as part of their Vulnerability
Contributor Program.

The time line is as follows:

* May 7, 2007: Initial defect disclosure to the security@samba.org
  email alias.
* May 7, 2007: Initial developer response by Samba
  developer Gerald Carter.
* May 9, 2007: Patch released by Samba developer Jeremy
  Allison to iDefense for testing.
* May 10, Announcement to vendor-sec mailing list
* May 14, 2007: Public announcement of the security issue.



==========================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
==========================================================






- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFGR5YAIR7qMdg1EfYRAn91AKDpPgSVlYSbMEkxpIAWG9rD1Cl6kwCffrRO
VCdq+1LtZsACYv7Yt1sQKyE=
=wtvM
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBRkj9Vih9+71yA2DNAQJkaQP/SHacMMKsoHokc0RtmAV8O4XZ+5IHQzSy
+me9ZPtfOFUG2IjPBf/bSdD3WAZ3AWa9rn+DCz+RL4OMbdxrSvIv1riin79IWIvb
wnqdBhxcp1Ct3ZGdq8msAnNzSVlWEVojUAUiMtFXb3JHBRpWrtUZgAqEaiFIDwD7
kLb3NzfRczc=
=/eJv
-----END PGP SIGNATURE-----