__________________________________________________________

                       The U.S. Department of Energy
                   Computer Incident Advisory Capability
                           ___  __ __    _     ___
                          /       |     /_\   /
                          \___  __|__  /   \  \___
             __________________________________________________________

                             INFORMATION BULLETIN

          Samba 'call_trans2open' Remote Buffer Overflow Vulnerability
                    [Samba (7 Apr, 2003) Security Advisory]

April 7, 2003 18:00 GMT                                           Number N-073
______________________________________________________________________________
PROBLEM:       A buffer overflow vulnerability in Samba occurs in the
               'call_trans2open()' function when copying data into a 1024 byte
               static buffer. Sufficent bounds checking is not carried out to
               prevent this vulnerability.
AFFECTED       
SOFTWARE:      All versions of Samba up to and including Samba 2.2.8.
DAMAGE:        This vulnerability could allow an anonymous remote attacker to
               execute arbitrary code with super user privileges by sending
               data in excess of 1024 bytes.
SOLUTION:      Upgrade to Samba 2.2.8a.
______________________________________________________________________________
VULNERABILITY  The risk is HIGH. An active exploit of this vulnerability has
ASSESSMENT:    been reported in the wild. A successful remote attacker could
               potentially overwrite sensitive stack variables. Subsequently,
               an ability to influence sensitive memory could be used to
               execute arbitrary code with the Samba server process
               privileges, typically root.
______________________________________________________________________________
LINKS:
 CIAC BULLETIN:      http://www.ciac.org/ciac/bulletins/n-073.shtml
 ORIGINAL BULLETIN:  http://us2.samba.org/samba/samba.html
 UPGRADE:            SEE SECTION TITLED: Samba News dated 7 Apr, 2003 Security 
                     Advisory, Samba 2.2.8a security available for download.
______________________________________________________________________________
[***** Start Samba (7 Apr, 2003) Security Advisory *****]

(7 Apr, 2003) Security Advisory - Samba 2.2.8a security available for
download 

Digital Defense, Inc. has alerted the Samba Team to a serious
vulnerability in all stable versions of Samba currently shipping. The
Common Vulnerabilities and Exposures (CVE) project has assigned the
ID CAN-2003-0201 to this defect. 

This vulnerability, if exploited correctly, leads to an anonymous user
gaining root access on a Samba serving system. All versions of Samba up
to and including Samba 2.2.8 are vulnerable. An active exploit of the bug
has been reported in the wild. Alpha versions of Samba 3.0 and above
are *NOT* vulnerable.

The 2.2.8a release contains only updates to address this security issue. A
rollup patch for release 2.2.7a and 2.0.10 addressing both
CAN-2003-0201 and CAN-2003-0085 can be obtained from this
directory. 

The source tarball is available in both gzip format and bzip2 format. The
uncompressed tarball signature should also be downloaded to verify the
archive's integrity. Here is the Samba Distribution Key for verifying the
tarball. Finally, here is the patchfile against 2.2.8 (signature). 

[***** End Samba (7 Apr, 2003) Security Advisory *****]
_______________________________________________________________________________

CIAC wishes to acknowledge the contributions of Samba and Symantec Corp. for the
information contained in this bulletin.
_______________________________________________________________________________

CIAC, the Computer Incident Advisory Capability, is the computer
security incident response team for the U.S. Department of Energy
(DOE) and the emergency backup response team for the National
Institutes of Health (NIH). CIAC is located at the Lawrence Livermore
National Laboratory in Livermore, California. CIAC is also a founding
member of FIRST, the Forum of Incident Response and Security Teams, a
global organization established to foster cooperation and coordination
among computer security teams worldwide.

CIAC services are available to DOE, DOE contractors, and the NIH. CIAC
can be contacted at:
    Voice:    +1 925-422-8193 (7x24)
    FAX:      +1 925-423-8002
    STU-III:  +1 925-423-2604
    E-mail:   ciac@ciac.org

Previous CIAC notices, anti-virus software, and other information are
available from the CIAC Computer Security Archive.

   World Wide Web:      http://www.ciac.org/
   Anonymous FTP:       ftp.ciac.org

PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing
communities receive CIAC bulletins.  If you are not part of these
communities, please contact your agency's response team to report
incidents. Your agency's team will coordinate with CIAC. The Forum of
Incident Response and Security Teams (FIRST) is a world-wide
organization. A list of FIRST member organizations and their
constituencies can be obtained via WWW at http://www.first.org/.

This document was prepared as an account of work sponsored by an
agency of the United States Government. Neither the United States
Government nor the University of California nor any of their
employees, makes any warranty, express or implied, or assumes any
legal liability or responsibility for the accuracy, completeness, or
usefulness of any information, apparatus, product, or process
disclosed, or represents that its use would not infringe privately
owned rights. Reference herein to any specific commercial products,
process, or service by trade name, trademark, manufacturer, or
otherwise, does not necessarily constitute or imply its endorsement,
recommendation or favoring by the United States Government or the
University of California. The views and opinions of authors expressed
herein do not necessarily state or reflect those of the United States
Government or the University of California, and shall not be used for
advertising or product endorsement purposes.

LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC)

N-063: Microsoft Windows Script Engine Vulnerability
N-064: Sun Buffer Overflow in Web Connector Module of Application Server
N-065: Multiple Vulnerabilities in Lotus Notes and Domino
N-066: RealPlayer PNG Deflate Heap Corruption Vulnerability
N-067: Sendmail MTA Buffer Overflow Vulnerability
N-068: Sun Solaris Buffer Overflow in lpq(1B) Command
N-069: Sun Solaris newtask(1) Command Vulnerability
N-070: Sun Solaris at(1) Command Vulnerability
N-071: Red Hat Eye of GNOME (EOG) Packages Fix Format String Vulnerability
N-072: Sun Solaris dtsession Security Vulnerability