10 - USN-41-1

Executive Summary

Summary
Title	Samba vulnerability

Informations
Name	USN-41-1	First vendor Publication	2004-12-17
Vendor	Ubuntu	Last vendor Modification	2004-12-17
Severity (Vendor)	N/A	Revision	N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score	10	Attack Range	Network
Cvss Impact Score	10	Attack Complexity	Low
Cvss Expoit Score	10	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

A security issue affects the following Ubuntu releases:

Ubuntu 4.10 (Warty Warthog)

The following packages are affected:

samba

The problem can be corrected by upgrading the affected package to version 3.0.7-1ubuntu6.3. In general, a standard system upgrade is sufficient to effect the necessary changes.

Details follow:

Greg MacManus discovered an integer overflow in Samba's smbd daemon. Requesting a very large number of access control descriptors from the server caused an integer overflow, which resulted in a memory allocation being too short, thus causing a buffer overflow. By sending carefully crafted data, an attacker could exploit this to execute arbitrary code on the server with full root permissions.