Debian Security Advisory

DSA-200-1 samba -- remote exploit

Date Reported:
22 Nov 2002
Affected Packages:
Security database references:
In Mitre's CVE dictionary: CVE-2002-1318.
More information:

Steve Langasek found an exploitable bug in the password handling code in samba: when converting from DOS code-page to little endian UCS2 unicode a buffer length was not checked and a buffer could be overflowed. There is no known exploit for this, but an upgrade is strongly recommended.

This problem has been fixed in version 2.2.3a-12 of the Debian samba packages and upstream version 2.2.7.

Fixed in:

Debian GNU/Linux 3.0 (woody)

Architecture-independent component:
alpha (DEC Alpha):
arm (ARM):
hppa (HP PA RISC):
i386 (Intel ia32):
ia64 (Intel ia64):
powerpc (PowerPC):
s390 (IBM S/390):
sparc (Sun SPARC/UltraSPARC):

MD5 checksums of the listed files are available in the original advisory.