SMB: Samba receive_smb_raw SMB Packets Parsing Buffer Overflow

This signature detects attempts to exploit a known vulnerability in the Samba package. A successful attack can lead to a buffer overflow and arbitrary remote code execution within the context of the affected user.

Extended Description

Samba is prone to a remote heap-based buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data before copying it to an insufficiently sized memory buffer. The issue occurs when the application processes SMB packets in a client context. An attacker can exploit this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will likely result in a denial of service. The issue affects Samba 3.0.28a and 3.0.29; other versions may also be affected. NOTE: This BID was originally titled 'Samba 'lib/util_sock.c' Buffer Overflow Vulnerability'. The title was changed to better identify the issue.

Affected Products

Xerox workcentre_pro,Samba samba

References

BugTraq: 29404

CVE: CVE-2008-1105

Short Name

SMB:OF:RECV-RAW-BO

Severity

Major

Recommended

False

Recommended Action

Drop

SMB: Samba receive_smb_raw SMB Packets Parsing Buffer Overflow

Extended Description

Affected Products

References

Found a potential security threat?