Samba MS-RPC Shell命令注入漏洞

漏洞信息详情

Samba MS-RPC Shell命令注入漏洞

• CNNVD编号：CNNVD-200705-286
• 危害等级： 中危
  
  
• CVE编号：
  CVE-2007-2447
  
• 漏洞类型：
  
  
  代码注入
  
• 发布时间：
  
  2006-06-01
  
• 威胁类型：
  
  
  远程
  
• 更新时间：
  
  2007-07-30
  
• 厂        商：
  
  samba
• 漏洞来源：
  Joshua J. Drake

Samba是Samba团队开发的一套可使UNIX系列的操作系统与微软Windows操作系统的SMB/CIFS网络协议做连结的自由软件。该软件支持共享打印机、互相传输资料文件等。

Samba在处理用户数据时存在输入验证漏洞，远程攻击者可能利用此漏洞在服务器上执行任意命令。

Samba中负责在SAM数据库更新用户口令的代码未经过滤便将用户输入传输给了/bin/sh。如果在调用smb.conf中定义的外部脚本时，通过对/bin/sh的MS-RPC调用提交了恶意输入的话，就可能允许攻击者以nobody用户的权限执行任意命令。

临时解决方法：

* 从smb.conf文件删除username map script选项。

厂商补丁：

Debian

——

Debian已经为此发布了一个安全公告(DSA-1291-2)以及相应补丁:

DSA-1291-2：New samba packages fix multiple vulnerabilities

链接：
http://www.debian.org/security/2007/dsa-1291” target=”_blank”>

http://www.debian.org/security/2007/dsa-1291

补丁下载：

Source archives:

http://security.debian.org/pool/updates/main/s/samba/samba_3.0.14a-3sarge6.diff.gz” target=”_blank”>

http://security.debian.org/pool/updates/main/s/samba/samba_3.0.14a-3sarge6.diff.gz

Size/MD5 checksum: 122946 4f8326351368c07b9ff7e4925f65bc64

http://security.debian.org/pool/updates/main/s/samba/samba_3.0.14a.orig.tar.gz” target=”_blank”>

http://security.debian.org/pool/updates/main/s/samba/samba_3.0.14a.orig.tar.gz

Size/MD5 checksum: 15605851 ebee37e66a8b5f6fd328967dc09088e8

http://security.debian.org/pool/updates/main/s/samba/samba_3.0.14a-3sarge6.dsc” target=”_blank”>

http://security.debian.org/pool/updates/main/s/samba/samba_3.0.14a-3sarge6.dsc

Size/MD5 checksum: 1081 c3bcc5438c9dc922f5ac9bc75bf825cb

Architecture independent packages:

http://security.debian.org/pool/updates/main/s/samba/samba-doc_3.0.14a-3sarge6_all.deb” target=”_blank”>

http://security.debian.org/pool/updates/main/s/samba/samba-doc_3.0.14a-3sarge6_all.deb

Size/MD5 checksum: 12117076 75895a83ad2be113b383bdf4d5f16c24

alpha architecture (DEC Alpha)

http://security.debian.org/pool/updates/main/s/samba/samba_3.0.14a-3sarge6_alpha.deb” target=”_blank”>

http://security.debian.org/pool/updates/main/s/samba/samba_3.0.14a-3sarge6_alpha.deb

Size/MD5 checksum: 3128680 fdc226d93c10ffb386b3c9bcff83314e

http://security.debian.org/pool/updates/main/s/samba/smbclient_3.0.14a-3sarge6_alpha.deb” target=”_blank”>

http://security.debian.org/pool/updates/main/s/samba/smbclient_3.0.14a-3sarge6_alpha.deb

Size/MD5 checksum: 3251018 e3eb57b061d45bc4fd20083292cf2075

http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.0.14a-3sarge6_alpha.deb” target=”_blank”>

http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.0.14a-3sarge6_alpha.deb

Size/MD5 checksum: 20269380 bf7af04d9d769277c42e004fafd908a1

http://security.debian.org/pool/updates/main/s/samba/python2.3-samba_3.0.14a-3sarge6_alpha.deb” target=”_blank”>

http://security.debian.org/pool/updates/main/s/samba/python2.3-samba_3.0.14a-3sarge6_alpha.deb

Size/MD5 checksum: 5237292 ca9d898183187b3db37131b8be456c65

http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.0.14a-3sarge6_alpha.deb” target=”_blank”>

http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.0.14a-3sarge6_alpha.deb

Size/MD5 checksum: 659878 4b35df8ced7e2aea0080c1aed7c0f9eb

http://security.debian.org/pool/updates/main/s/samba/swat_3.0.14a-3sarge6_alpha.deb” target=”_blank”>

http://security.debian.org/pool/updates/main/s/samba/swat_3.0.14a-3sarge6_alpha.deb

Size/MD5 checksum: 4223662 5401c52bda1aee10d4c919b794c69f9a

http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.0.14a-3sarge6_alpha.deb” target=”_blank”>

http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.0.14a-3sarge6_alpha.deb

Size/MD5 checksum: 1015318 dadfd640543ef97d00b438d2e6c6cab9

http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.0.14a-3sarge6_alpha.deb” target=”_blank”>

http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.0.14a-3sarge6_alpha.deb

Size/MD5 checksum: 402080 6025f427e4f2079a9a3c0d38ccff2590

http://security.debian.org/pool/updates/main/s/samba/samba-common_3.0.14a-3sarge6_alpha.deb” target=”_blank”>

http://security.debian.org/pool/updates/main/s/samba/samba-common_3.0.14a-3sarge6_alpha.deb

Size/MD5 checksum: 2408536 f3dc91c30a136ccc0258fb46717d1100

http://security.debian

参考网址

来源: VU#268336

名称: VU#268336

链接:http://www.kb.cert.org/vuls/id/268336

来源: BUGTRAQ

名称: 20070513 [SAMBA-SECURITY] CVE-2007-2447: Remote Command Injection Vulnerability

链接:http://www.securityfocus.com/archive/1/archive/1/468565/100/0/threaded

来源: www.samba.or g

链接:http://www.samba.org/samba/security/CVE-2007-2447.html

来源: issues.rpath.com

链接:https://issues.rpath.com/browse/RPL-1366

来源: UBUNTU

名称: USN-460-1

链接:http://www.ubuntu.com/usn/usn-460-1

来源: TRUSTIX

名称: 2007-0017

链接:http://www.trustix.org/errata/2007/0017/

来源: SECTRACK

名称: 1018051

链接:http://www.securitytracker.com/id?1018051

来源: BID

名称: 23972

链接:http://www.securityfocus.com/bid/23972

来源: BUGTRAQ

名称: 20070515 FLEA-2007-0017-1: samba

链接:http://www.securityfocus.com/archive/1/archive/1/468670/100/0/threaded

来源: REDHAT

名称: RHSA-2007:0354

链接:http://www.redhat.com/support/errata/RHSA-2007-0354.html

来源: OSVDB

名称: 34700

链接:http://www.osvdb.org/34700

来源: VUPEN

名称: ADV-2007-1805

链接:http://www.frsirt.com/english/advisories/2007/1805

来源: DEBIAN

名称: DSA-1291

链接:http://www.debian.org/security/2007/dsa-1291

来源: SLACKWARE

名称: SSA:2007-134-01

链接: http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.475906

来源: GENTOO

名称: GLSA-200705-15

链接:http://security.gentoo.org/glsa/glsa-200705-15.xml

来源: SECUNIA

名称: 25270

链接:http://secunia.com/advisories/25270

来源: SECUNIA

名称: 25259

链接:http://secunia.com/advisories/25259

来源: SECUNIA

名称: 25257

链接:http://secunia.com/advisories/25257

来源: SECUNIA

名称: 25256

链接:http://secunia.com/advisories/25256

来源: SECUNIA

名称: 25255

链接:http://secunia.com/advisories/25255

来源: SECUNIA

名称: 25251

链接:http://secunia.com/advisories/25251

来源: SECUNIA

名称: 25246

链接:http://secunia.com/advisories/25246

来源: SECUNIA

名称: 25241

链接:http://secunia.com/advisories/25241

来源: SECUNIA

名称: 25232

链接:http://secunia.com/advisories/25232

来源: IDEFENSE

名称: 20070514 Samba SAMR Change Password Remote Command Injection Vulnerability

链接:http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=534

来源: MANDRIVA

名称: MDKSA-2007:104

链接:http://frontal2.mandriva.com/security/advisories?name=MDKSA-2007:104

来源: www.xerox.com

链接:http://www.xerox.com/downloads/usa/en/c/cert_XRX08_001.pdf

来源: BID

名称: 25159

链接:http://www.securityfocus.com/bid/25159

来源: OPENPKG

名称: OpenPKG-SA-2007.012

链接:http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.012.html

来源: SUSE

名称: SUSE-SR:2007:014

链接:http://www.novell.com/linux/security/advisories/2007_14_sr.html

来源: MANDRIVA

名称: MDKSA-2007:104

链接:http://www.mandriva.com/security/advisories?name=MDKSA-2007:104

来源: VUPEN

名称: ADV-2008-0050

链接:http://www.frsirt.com/english/advisories/2008/0050

来源: VUPEN

名称: ADV-2007-3229

链接:http://www.frsirt.com/english/advisories/2007/3229

来源: VUPEN

名称: ADV-2007-2732

链接:http://www.frsirt.com/english/advisories/2007/2732

来源: VUPEN

名称: ADV-2007-2281

链接:http://www.frsirt.com/english/advisories/2007/2281

来源: VUPEN

名称: ADV-2007-2210

链接:http://www.frsirt.com/english/advisories/2007/2210

来源: VUPEN

名称: ADV-2007-2079

链接:http://www.frsirt.com/english/advisories/2007/2079

来源: SUNALERT

名称: 200588

链接:http://sunsolve.sun.com/search/document.do?assetkey=1-66-200588-1

来源: SUNALERT

名称: 102964

链接:http://sunsolve.sun.com/search/document.do?assetkey=1-26-102964-1

来源: SREASON

名称: 2700

链接:http://securityreason.com/securityalert/2700

来源: SECUNIA

名称: 28292

链接:http://secunia.com/advisories/28292

来源: SECUNIA

名称: 27706

链接:http://secunia.com/advisories/27706

来源: SECUNIA

名称: 26909

链接:http://secunia.com/advisories/26909

来源: SECUNIA

名称: 26235

链接:http://secunia.com/advisories/26235

来源: SECUNIA

名称: 26083

链接:http://secunia.com/advisories/26083

来源: SECUNIA

名称: 25772

链接:http://secunia.com/advisories/25772

来源: SECUNIA

名称: 25675

链接:http://secunia.com/advisories/25675

来源: SECUNIA

名称: 25567

链接:http://secunia.com/advisories/

受影响实体