Title: SAMBA SWAT Logging Failure Vulnerability
Severity: MODERATE
Description:
The Samba software suite is a collection of programs that implements the SMB protocol for unix systems, allowing you to serve files and printers to Windows, NT, OS/2 and DOS clients. This protocol is sometimes also referred to as the LanManager or Netbios protocol. Samba ships with a utility titled SWAT (Samba Web Administration Tool) which is used for remote administration of the Samba server and is by default set to run from inetd as root on port 701. Certain versions of this software ship with a vulnerability remote users can abuse to potentially leverage system access.
This problem in particular is that the loging facility with certain versions of SWAT will not log bad login attempts if the remote user enters a correct username but wrong password. This in effect allows the remote user to continuously attack the service guessing passwords without being logged or locked out.
Affected Products:
- Caldera OpenLinux 2.3.0
- Conectiva Linux 4.0.0
- Conectiva Linux 4.0.0 es
- Conectiva Linux 4.1.0
- Conectiva Linux 4.2.0
- Conectiva Linux 5.0.0
- Conectiva Linux 5.1.0
- Conectiva Linux 6.0.0
- Conectiva Linux ecommerce
- Conectiva Linux graficas
- Debian Linux 2.2.0
- Debian Linux 2.2.0 68k
- Debian Linux 2.2.0 alpha
- Debian Linux 2.2.0 arm
- Debian Linux 2.2.0 powerpc
- Debian Linux 2.2.0 sparc
- Debian Linux 2.3.0
- Debian Linux 2.3.0 alpha
- Debian Linux 2.3.0 powerpc
- Debian Linux 2.3.0 sparc
- MandrakeSoft Linux Mandrake 7.0.0
- MandrakeSoft Linux Mandrake 7.1.0
- Progeny Debian 1.0.0
- RedHat Linux 7.0.0
- RedHat Linux 7.0.0 i386
- RedHat Linux 7.0.0 i686
- RedHat Linux 7.1.0
- RedHat Linux 7.1.0 i386
- RedHat Linux 7.1.0 i586
- RedHat Linux 7.1.0 i686
- SCO eDesktop 2.4.0
- SCO eServer 2.3.1
- Samba Samba 2.0.7
- Sun Cobalt Qube3 4000WG
- Sun Cobalt RaQ 550 4100R 0.0.0
- Sun Cobalt RaQ XTR 3500R
- Trustix Secure Linux 1.1.0
- Trustix Secure Linux 1.2.0
- WireX Immunix OS 6.2.0
- WireX Immunix OS 7.0.0
- WireX Immunix OS 7.0.0 -Beta
References:
- Miah: Writeup on the SWAT Vulnerability
- Samba: Samba Homepage
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
