----------------------------------------------------------------------

Secunia Network Software Inspector 2.0 (NSI) - Public Beta

The Public Beta has ended. Thanks to all that participated.

Learn more:
http://secunia.com/network_software_inspector_2/

----------------------------------------------------------------------

TITLE:
Samba "receive_smb_raw()" Buffer Overflow Vulnerability

SECUNIA ADVISORY ID:
SA30228

VERIFY ADVISORY:
http://secunia.com/advisories/30228/

CRITICAL:
Highly critical

IMPACT:
System access

WHERE:
>From remote

SOFTWARE:
Samba 2.x
http://secunia.com/product/1271/
Samba 3.x
http://secunia.com/product/2999/

DESCRIPTION:
Secunia Research has discovered a vulnerability in Samba, which can
be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to a boundary error within the
"receive_smb_raw()" function in lib/util_sock.c when parsing SMB
packets. This can be exploited to cause a heap-based buffer overflow
via an overly large SMB packet received in a client context.

Successful exploitation allows execution of arbitrary code by
tricking a user into connecting to a malicious server (e.g. by
clicking an "smb://" link) or by sending specially crafted packets to
an "nmbd" server configured as a local or domain master browser.

The vulnerability is confirmed in versions 3.0.28a and 3.0.29. Prior
versions may also be affected.

SOLUTION:
A patch and fixed version should be available later today.

Do not connect to untrusted SMB servers or follow untrusted links.

PROVIDED AND/OR DISCOVERED BY:
Alin Rad Pop, Secunia Research.

ORIGINAL ADVISORY:
Secunia Research:
http://secunia.com/secunia_research/2008-20/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------