Samba服务器call_trans2open远程缓冲区溢出漏洞

漏洞信息详情

Samba服务器call_trans2open远程缓冲区溢出漏洞

• CNNVD编号：CNNVD-200305-012
• 危害等级： 超危
  
  
• CVE编号：
  CVE-2003-0201
  
• 漏洞类型：
  
  
  边界条件错误
  
• 发布时间：
  
  2003-04-07
  
• 威胁类型：
  
  
  远程
  
• 更新时间：
  
  2005-10-20
  
• 厂        商：
  
  compaq
• 漏洞来源：
  Erik Parker※ erik….

Samba是一套实现SMB(Server Messages Block)协议，跨平台进行文件共享和打印共享服务的程序。Samba-TNG是一款Samba的衍生版本。
Samba程序由于对外部输入缺少正确的边界缓冲区检查，远程攻击者可以利用这个漏洞以root用户权限在系统上执行任意指令。
问题是smbd/trans2.c文件中的call_trans2open()函数调用：
StrnCpy(fname，pname，namelen); /* Line 252 of smbd/trans2.c */
StrnCpy函数使用namelen拷贝pname到fname中，如果变量namelen赋值为strlen(pname)+1，就会发生缓冲区溢出。变量\’\’fname\’\’是_typedef_ pstring类型，是大小为1024字节的字符，如果pname超过1024字节，就可以覆盖堆栈中的敏感地址，精心构建提交数据可能以root用户权限在系统上执行任意指令。

临时解决方法：
如果您不能立刻安装补丁或者升级，CNNVD建议您采取以下措施以降低威胁：

* 修改smbd/trans2.c中的250行：

-StrnCpy(fname,pname,namelen);

+StrnCpy(fname,pname,MIN(namelen, sizeof(fname)-1));
厂商补丁：
Debian
——
Debian已经为此发布了一个安全公告(DSA-280-1)以及相应补丁:

DSA-280-1：New samba packages fix remote root exploit

链接：http://www.debian.org/security/2002/dsa-280” target=”_blank”>
http://www.debian.org/security/2002/dsa-280

补丁下载：

Source archives:

http://security.debian.org/pool/updates/main/s/samba/samba_2.0.7-5.1.dsc” target=”_blank”>
http://security.debian.org/pool/updates/main/s/samba/samba_2.0.7-5.1.dsc

Size/MD5 checksum: 682 f6408cc26d6825708b42aee5804346aa

http://security.debian.org/pool/updates/main/s/samba/samba_2.0.7-5.1.diff.gz” target=”_blank”>
http://security.debian.org/pool/updates/main/s/samba/samba_2.0.7-5.1.diff.gz

Size/MD5 checksum: 84907 aa39196e9842b853e2ca6eccb69a67ee

http://security.debian.org/pool/updates/main/s/samba/samba_2.0.7.orig.tar.gz” target=”_blank”>
http://security.debian.org/pool/updates/main/s/samba/samba_2.0.7.orig.tar.gz

Size/MD5 checksum: 4276392 b5e61ea655d476072fd0365785fea2d0

Architecture independent components:

http://security.debian.org/pool/updates/main/s/samba/samba-doc_2.0.7-5.1_all.deb” target=”_blank”>
http://security.debian.org/pool/updates/main/s/samba/samba-doc_2.0.7-5.1_all.deb

Size/MD5 checksum: 1730866 e50fbefba3bdf5abeb136484a19cae19

Alpha architecture:

http://security.debian.org/pool/updates/main/s/samba/samba_2.0.7-5.1_alpha.deb” target=”_blank”>
http://security.debian.org/pool/updates/main/s/samba/samba_2.0.7-5.1_alpha.deb

Size/MD5 checksum: 1368434 6f5c06a774c9cdf07fe10d739221644f

http://security.debian.org/pool/updates/main/s/samba/samba-common_2.0.7-5.1_alpha.deb” target=”_blank”>
http://security.debian.org/pool/updates/main/s/samba/samba-common_2.0.7-5.1_alpha.deb

Size/MD5 checksum: 671138 07967650ed35874384c3cdf6f630f024

http://security.debian.org/pool/updates/main/s/samba/smbclient_2.0.7-5.1_alpha.deb” target=”_blank”>
http://security.debian.org/pool/updates/main/s/samba/smbclient_2.0.7-5.1_alpha.deb

Size/MD5 checksum: 751518 5ca4feb086cdd75e96a76c45ffed0761

http://security.debian.org/pool/updates/main/s/samba/smbfs_2.0.7-5.1_alpha.deb” target=”_blank”>
http://security.debian.org/pool/updates/main/s/samba/smbfs_2.0.7-5.1_alpha.deb

Size/MD5 checksum: 464608 1f59a2592e652886f33155f1b177733a

http://security.debian.org/pool/updates/main/s/samba/swat_2.0.7-5.1_alpha.deb” target=”_blank”>
http://security.debian.org/pool/updates/main/s/samba/swat_2.0.7-5.1_alpha.deb

Size/MD5 checksum: 303764 9d2f4dc0431453363c1ec61f110ebfd5

ARM architecture:

http://security.debian.org/pool/updates/main/s/samba/samba_2.0.7-5.1_arm.deb” target=”_blank”>
http://security.debian.org/pool/updates/main/s/samba/samba_2.0.7-5.1_arm.deb

Size/MD5 checksum: 1128522 3385d1640b33672a960b515a24076f73

http://security.debian.org/pool/updates/main/s/samba/samba-common_2.0.7-5.1_arm.deb” target=”_blank”>
http://security.debian.org/pool/updates/main/s/samba/samba-common_2.0.7-5.1_arm.deb

Size/MD5 checksum: 594892 3b0da8cf9d6baa38be60b20fd40d3e67

http://security.debian.org/pool/updates/main/s/samba/smbclient_2.0.7-5.1_arm.deb” target=”_blank”>
http://security.debian.org/pool/updates/main/s/samba/smbclient_2.0.7-5.1_arm.deb

Size/MD5 checksum: 611464 2d2293eb3af68122af74fce318fe1daf

http://security.debian.org/pool/updates/main/s/samba/smbfs_2.0.7-5.1_arm.deb” target=”_blank”>
http://security.debian.org/pool/updates/main/s/samba/smbfs_2.0.7-5.1_arm.deb

Size/MD5 checksum: 379972 810376b6f2eeb326c8b4077bab9a642d

http://security.debian.org/pool/updates/main/s/samba/swat_2.0.7-5.1_arm.deb” target=”_blank”>
http://security.debian.org/pool/updates/main/s/samba/swat_2.0.7-5.1_arm.deb

Size/MD5 checksum: 251962 8add539661bb6cf17feeb141179f5e5e

Intel IA-32 architecture:

http://security.debian.org/pool/updates/main/s/samba/samba_2.0.7-5.1_i386.deb” target=”_blank”>
http://security.debian.org/pool/updates/main/s/samba/samba_2.0.7-5.1_i386.deb

Size/MD5 checksum: 1038178 85520066846690baf161dcd1e109e3b4

http://security.debian.org/pool/updates/main/s/samba/samba-common_2.0.7-5.1_i386.deb” target=”_blank”>
http://security.debian.org/pool/updates/main/s/samba/samba-common_2.0.7-5.1_i386.deb

Size/MD5 checksum: 570658 e7cf4ae028c0e629bf5d4ebd4e762840

http://security.debian.org/pool/updates/main/s/samba/smbclient_2.0.7-5.1_i386.deb” target=”_blank”>
http://security.debian.org/pool/updates/main/s/samba/smbclient_2.0.7-5.1_i386.deb

Size/MD5 checksum: 560702 4b15aab22dc0b5d5d43f3094594261dc

http://security.debian.org/pool/updates/main/s/samba/smbfs_2.0.7-5.1_i386.deb” target=”_blank”>
http://security.debian.org/pool/updates/main/s/samba/smbfs_2.0.7-5.1_i386.deb

Size/MD5 checksum: 351374 7baebac78c9f9db2d474d549193b3229

http://security.debian.org/pool/updates/main/s/samba/swat_2.0.7-5.1_i386.deb” target=”_blank”>
http://security.debian.org/pool/updates/main/s/samba/swat_2.0.7-5.1_i386.deb

Size/MD5 checksum: 233416 521feb878fe8c9d0d145cabc98de136f

Motorola 680×0 architecture:

http://security.debian.org/pool/updates/main/s/samba/samba_2.0.7-5.1_m68k.deb” target=”_blank”>
http://security.debian.org/pool/updates/main/s/samba/samba_2.0.7-5.1_m68k.deb

Size/MD5 checksum: 993334 465a088df279605a161bceb13d3fadc7

http://security.debian.org/pool/updates/main/s/samba/samba-common_2.0.7-5.1_m68k.deb” target=”_blank”>
http://security.debian.org/pool/updates/main/s/samba/samba-common_2.0.7-5.1_m68k.deb

Size/MD5 checksum: 557152 88a5169cabadefcf300d46dff7009535

http://security.debian.org/pool/updates/main/s/samba/smbclient_2.0.7-5.1_m68k.deb” target=”_blank”>
http://security.debian.org/pool/updates/main/s/samba/smbclient_2.0.7-5.1_m68k.deb

Size/MD5 checksum: 536528 20e0c945b6b4f26df08a878a93abb260

http://security.debian.org/pool/updates/main/s/samba/smbfs_2.0.7-5.1_m68k.deb” target=”_blank”>
http://security.debian.org/pool/updates/main/s/samba/smbfs_2.0.7-5.1_m68k.deb

Size/MD5 checksum: 339706 319d3aba8172f071040a192ee40d0fce

http://security.debian.org/pool/updates/main/s/samba/swat_2.0.7-5.1_m68k.deb” target=”_blank”>
http://security.debian.org/pool/updates/main/s/samba/swat_2.0.7-5.1_m68k.deb

Size/MD5 checksum: 222556 dbdbac65a0bc736fbed9bcc42c3dabb1

PowerPC architecture:

http://security.debian.org/pool/updates/main/s/samba/samba_2.0.7-5.1_powerpc.deb” target=”_blank”>
http://security.debian.org/pool/updates/main/s/samba/samba_2.0.7-5.1_powerpc.deb

Size/MD5 checksum: 1124154 e4624fae9942e547c68fcdbfbb88bb7d

http://security.debian.org/pool/updates/main/s/samba/samba-common_2.0.7-5.1_powerpc.deb” target=”_blank”>
http://security.debian.org/pool/updates/main/s/samba/samba-common_2.0.7-5.1_powerpc.deb

Size/MD5 checksum: 594476 7146e39be6c26d868073b608230bd340

http://security.debian.org/pool/updates/main/s/samba/smbclient_2.0.7-5.1_powerpc.deb” target=”_blank”>
http://security.debian.org/pool/updates/main/s/samba/smbclient_2.0.7-5.1_powerpc.deb

Size/MD5 checksum: 610070 0e78c52db69ad9b7a52da770e3298878

http://security.debian.org/pool/updates/main/s/samba/smbfs_2.0.7-5.1_powerpc.deb” target=”_blank”>
http://security.debian.org/pool/updates/main/s/samba/smbfs_2.0.7-5.1_powerpc.deb

Size/MD5 checksum: 382148 5b5cbb24a03eca3ec9b78ae13d4fa614

http://security.debian.org/pool/updates/main/s/samba/swat_2.0.7-5.1_powerpc.deb” target=”_blank”>
http://security.debian.org/pool/updates/main/s/samba/swat_2.0.7-5.1_pow