Samba: Data disclosure — GLSA 200903-07

A missing boundary check in Samba might lead to the disclosure of memory contents.

Affected packages

net-fs/samba on all architectures
Affected versions < 3.0.33
Unaffected versions >= 3.0.33

Background

Samba is a suite of SMB and CIFS client/server programs.

Description

Samba does not properly check memory boundaries when handling trans, rans2, and nttrans requests.

Impact

A remote attacker could send specially crafted requests to a Samba daemon, leading to the disclosure of arbitrary memory or to a Denial of Service.

Workaround

There is no known workaround at this time.

Resolution

All Samba users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=net-fs/samba-3.0.33"

References

Release date
March 07, 2009

Latest revision
March 07, 2009: 01

Severity
normal

Exploitable
remote

Bugzilla entries