Knowledge Base

Release Date: 3/10/2008
Document Last Updated: 3/10/2008

Summary

1. Alin Rad Pop of Secunia Research found a stack buffer overflow flaw in the way Samba authenticates remote users. A remote unauthenticated user can trigger this flaw to cause the Samba server to crash, or execute arbitrary code with the permissions of the Samba server.
   
   The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2007-6015 to this issue.
   
   
2. This patch also fixes a regression caused by the fix for CVE-2007-4572 and previously included in patch ESX350-200712402-SG, which prevented some clients from being able to properly access shares. The issues fixed for this CVE include:
   
   
   • An issue where attackers on the service console management network can cause a stack-based buffer overflow in the reply_netbios_packet function of nmbd in Samba. On systems where Samba is being used as a WINS server, exploiting this vulnerability can allow remote attackers to execute arbitrary code via crafted WINS Name Registration requests followed by a WINS Name Query request.
     
     
   • An issue where attackers on the service console management network can exploit a vulnerability that occurs when Samba is configured as a primary or backup domain controller. The vulnerability allows remote attackers to have an unknown impact via crafted GETDC mailslot requests, related to handling of GETDC logon server requests.
     
   
   
   
   The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2007-5398 and CVE-2007-4572 to these issues.

Note: These vulnerabilities can be exploited only if the attacker has access to the service console network. See the VMware Security Best Practices document http://www.vmware.com/resources/techresources/726 for configuration recommendations which enable ESX Server systems to resist this type of issue.