Samba服务器call_trans2open远程缓冲区溢出漏洞

admin

0
文章

0
评论

2022-07-18 14:46:31 CNNVD漏洞来源：ZONE.CI 全球网 0 阅读模式

漏洞信息详情

Samba服务器call_trans2open远程缓冲区溢出漏洞

CNNVD编号：CNNVD-200305-012
危害等级：超危
CVE编号： CVE-2003-0201
漏洞类型：边界条件错误
发布时间： 2003-04-07
威胁类型：远程
更新时间： 2005-10-20
厂商： compaq
漏洞来源： Erik Parker※ erik....

漏洞简介

Samba是一套实现SMB(Server Messages Block)协议，跨平台进行文件共享和打印共享服务的程序。Samba-TNG是一款Samba的衍生版本。 Samba程序由于对外部输入缺少正确的边界缓冲区检查，远程攻击者可以利用这个漏洞以root用户权限在系统上执行任意指令。问题是smbd/trans2.c文件中的call_trans2open()函数调用： StrnCpy(fname，pname，namelen); /* Line 252 of smbd/trans2.c */ StrnCpy函数使用namelen拷贝pname到fname中，如果变量namelen赋值为strlen(pname)+1，就会发生缓冲区溢出。变量\'\'fname\'\'是_typedef_ pstring类型，是大小为1024字节的字符，如果pname超过1024字节，就可以覆盖堆栈中的敏感地址，精心构建提交数据可能以root用户权限在系统上执行任意指令。

漏洞公告

临时解决方法：如果您不能立刻安装补丁或者升级，CNNVD建议您采取以下措施以降低威胁：

* 修改smbd/trans2.c中的250行：

-StrnCpy(fname,pname,namelen);

+StrnCpy(fname,pname,MIN(namelen, sizeof(fname)-1)); 厂商补丁： Debian ------ Debian已经为此发布了一个安全公告(DSA-280-1)以及相应补丁:

DSA-280-1：New samba packages fix remote root exploit

链接： http://www.debian.org/security/2002/dsa-280

补丁下载：

Source archives:

http://security.debian.org/pool/updates/main/s/samba/samba_2.0.7-5.1.dsc

Size/MD5 checksum: 682 f6408cc26d6825708b42aee5804346aa

http://security.debian.org/pool/updates/main/s/samba/samba_2.0.7-5.1.diff.gz

Size/MD5 checksum: 84907 aa39196e9842b853e2ca6eccb69a67ee

http://security.debian.org/pool/updates/main/s/samba/samba_2.0.7.orig.tar.gz

Size/MD5 checksum: 4276392 b5e61ea655d476072fd0365785fea2d0

Architecture independent components:

http://security.debian.org/pool/updates/main/s/samba/samba-doc_2.0.7-5.1_all.deb

Size/MD5 checksum: 1730866 e50fbefba3bdf5abeb136484a19cae19

Alpha architecture:

http://security.debian.org/pool/updates/main/s/samba/samba_2.0.7-5.1_alpha.deb

Size/MD5 checksum: 1368434 6f5c06a774c9cdf07fe10d739221644f

http://security.debian.org/pool/updates/main/s/samba/samba-common_2.0.7-5.1_alpha.deb

Size/MD5 checksum: 671138 07967650ed35874384c3cdf6f630f024

http://security.debian.org/pool/updates/main/s/samba/smbclient_2.0.7-5.1_alpha.deb

Size/MD5 checksum: 751518 5ca4feb086cdd75e96a76c45ffed0761

http://security.debian.org/pool/updates/main/s/samba/smbfs_2.0.7-5.1_alpha.deb

Size/MD5 checksum: 464608 1f59a2592e652886f33155f1b177733a

http://security.debian.org/pool/updates/main/s/samba/swat_2.0.7-5.1_alpha.deb

Size/MD5 checksum: 303764 9d2f4dc0431453363c1ec61f110ebfd5

ARM architecture:

http://security.debian.org/pool/updates/main/s/samba/samba_2.0.7-5.1_arm.deb

Size/MD5 checksum: 1128522 3385d1640b33672a960b515a24076f73

http://security.debian.org/pool/updates/main/s/samba/samba-common_2.0.7-5.1_arm.deb

Size/MD5 checksum: 594892 3b0da8cf9d6baa38be60b20fd40d3e67

http://security.debian.org/pool/updates/main/s/samba/smbclient_2.0.7-5.1_arm.deb

Size/MD5 checksum: 611464 2d2293eb3af68122af74fce318fe1daf

http://security.debian.org/pool/updates/main/s/samba/smbfs_2.0.7-5.1_arm.deb

Size/MD5 checksum: 379972 810376b6f2eeb326c8b4077bab9a642d

http://security.debian.org/pool/updates/main/s/samba/swat_2.0.7-5.1_arm.deb

Size/MD5 checksum: 251962 8add539661bb6cf17feeb141179f5e5e

Intel IA-32 architecture:

http://security.debian.org/pool/updates/main/s/samba/samba_2.0.7-5.1_i386.deb

Size/MD5 checksum: 1038178 85520066846690baf161dcd1e109e3b4

http://security.debian.org/pool/updates/main/s/samba/samba-common_2.0.7-5.1_i386.deb

Size/MD5 checksum: 570658 e7cf4ae028c0e629bf5d4ebd4e762840

http://security.debian.org/pool/updates/main/s/samba/smbclient_2.0.7-5.1_i386.deb

Size/MD5 checksum: 560702 4b15aab22dc0b5d5d43f3094594261dc

http://security.debian.org/pool/updates/main/s/samba/smbfs_2.0.7-5.1_i386.deb

Size/MD5 checksum: 351374 7baebac78c9f9db2d474d549193b3229

http://security.debian.org/pool/updates/main/s/samba/swat_2.0.7-5.1_i386.deb

Size/MD5 checksum: 233416 521feb878fe8c9d0d145cabc98de136f

Motorola 680x0 architecture:

http://security.debian.org/pool/updates/main/s/samba/samba_2.0.7-5.1_m68k.deb

Size/MD5 checksum: 993334 465a088df279605a161bceb13d3fadc7

http://security.debian.org/pool/updates/main/s/samba/samba-common_2.0.7-5.1_m68k.deb

Size/MD5 checksum: 557152 88a5169cabadefcf300d46dff7009535

http://security.debian.org/pool/updates/main/s/samba/smbclient_2.0.7-5.1_m68k.deb

Size/MD5 checksum: 536528 20e0c945b6b4f26df08a878a93abb260

http://security.debian.org/pool/updates/main/s/samba/smbfs_2.0.7-5.1_m68k.deb

Size/MD5 checksum: 339706 319d3aba8172f071040a192ee40d0fce

http://security.debian.org/pool/updates/main/s/samba/swat_2.0.7-5.1_m68k.deb

Size/MD5 checksum: 222556 dbdbac65a0bc736fbed9bcc42c3dabb1

PowerPC architecture:

http://security.debian.org/pool/updates/main/s/samba/samba_2.0.7-5.1_powerpc.deb

Size/MD5 checksum: 1124154 e4624fae9942e547c68fcdbfbb88bb7d

http://security.debian.org/pool/updates/main/s/samba/samba-common_2.0.7-5.1_powerpc.deb

Size/MD5 checksum: 594476 7146e39be6c26d868073b608230bd340

http://security.debian.org/pool/updates/main/s/samba/smbclient_2.0.7-5.1_powerpc.deb

Size/MD5 checksum: 610070 0e78c52db69ad9b7a52da770e3298878

http://security.debian.org/pool/updates/main/s/samba/smbfs_2.0.7-5.1_powerpc.deb

Size/MD5 checksum: 382148 5b5cbb24a03eca3ec9b78ae13d4fa614

http://security.debian.org/pool/updates/main/s/samba/swat_2.0.7-5.1_pow

参考网址

来源:US-CERT Vulnerability Note: VU#267873 名称: VU#267873 链接:http://www.kb.cert.org/vuls/id/267873 来源: BID 名称: 7294 链接:http://www.securityfocus.com/bid/7294 来源: DEBIAN 名称: DSA-280 链接:http://www.debian.org/security/2003/dsa-280 来源: BUGTRAQ 名称: 20030407 [DDI-1013] Buffer Overflow in Samba allows remote root compromise 链接:http://marc.theaimsgroup.com/?l=bugtraq&m=104972664226781&w=2 来源: REDHAT 名称: RHSA-2003:137 链接:http://www.redhat.com/support/errata/RHSA-2003-137.HTML 来源: SUSE 名称: SuSE-SA:2003:025 链接:http://www.novell.com/linux/security/advisories/2003_025_samba.HTML 来源: www.digitaldefense.net 链接:http://www.digitaldefense.net/labs/advisories/DDI-1013.txt 来源: SGI 名称: 20030403-01-P 链接:ftp://patches.sgi.com/support/free/security/advisories/20030403-01-P 来源: MANDRAKE 名称: MDKSA-2003:044 链接:http://www.mandriva.com/security/advisories?name=MDKSA-2003:044 来源: BUGTRAQ 名称: 20030409 GLSA: samba (200304-02) 链接:http://marc.theaimsgroup.com/?l=bugtraq&m=104994564212488&w=2 来源: BUGTRAQ 名称: 20030408 [Sorcerer-spells] SAMBA--SORCERER2003-04-08 链接:http://marc.theaimsgroup.com/?l=bugtraq&m=104981682014565&w=2 来源: BUGTRAQ 名称: 20030407 Immunix Secured OS 7+ samba update 链接:http://marc.theaimsgroup.com/?l=bugtraq&m=104974612519064&w=2 来源: CONECTIVA 名称: CLA-2003:624 链接:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000624 来源: US Government Resource: oval:org.mitre.oval:def:567 名称: oval:org.mitre.oval:def:567 链接:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:567 来源: US Government Resource: oval:org.mitre.oval:def:2163 名称: oval:org.mitre.oval:def:2163 链接:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:2163