SMB: Mangling File Buffer Overflow

This signature detects attempts to exploit a known vulnerability in the mangling functionality in Samba. A successful attacker can execute arbitrary code with Samba process privileges.

Extended Description

Samba is reported prone to an undisclosed buffer overrun vulnerability, the buffer overrun is reported to exist when Samba is handling file name mangling with the "hash" method. It is conjectured that this vulnerability may present itself when the affected server handles a filename that is sufficient to trigger the vulnerability. To exploit this vulnerability, an attacker may require sufficient access so that they may write a file to a published samba share. It is reported that the vulnerability does not exist in default Samba configurations; by default, Samba is configured to employ "hash2" name mangling. The "hash2" method is not vulnerable. This vulnerability is reported to affect Samba version 3.0.0 and later.

Affected Products

Sun solaris

References

BugTraq: 10781

CVE: CVE-2004-0686

URL: http://xforce.iss.net/xforce/xfdb/16786 http://marc.theaimsgroup.com/?l=bugtraq&m=109051340810458&w=2

Short Name

SMB:OF:MANGLING-FILE-OF

Severity

Major

Recommended

False

Recommended Action

Drop

SMB: Mangling File Buffer Overflow

Extended Description

Affected Products

References

Found a potential security threat?