Debian Security Advisory

DSA-262-1 samba -- remote exploit

Date Reported:
15 Mar 2003
Affected Packages:
Security database references:
In the Bugtraq database (at SecurityFocus): BugTraq ID 7107, BugTraq ID 7106.
In Mitre's CVE dictionary: CVE-2003-0085, CVE-2003-0086.
More information:

Sebastian Krahmer of the SuSE security audit team found two problems in samba, a popular SMB/CIFS implementation. The problems are:

  • a buffer overflow in the SMB/CIFS packet fragment re-assembly code used by smbd. Since smbd runs as root an attacker can use this to gain root access to a machine running smbd.
  • the code to write reg files was vulnerable for a chown race which made it possible for a local user to overwrite system files

Both problems have been fixed in upstream version 2.2.8, and version 2.2.3a-12.1 of package for Debian GNU/Linux 3.0/woody.

Fixed in:

Debian GNU/Linux 3.0 (woody)

Architecture-independent component:
alpha (DEC Alpha):
arm (ARM):
hppa (HP PA RISC):
i386 (Intel ia32):
ia64 (Intel ia64):
mips (MIPS (Big Endian)):
mipsel (MIPS (Little Endian)):
powerpc (PowerPC):
s390 (IBM S/390):
sparc (Sun SPARC/UltraSPARC):

MD5 checksums of the listed files are available in the original advisory.