Bugzilla Bug 139369

We've got a small anonymous DoS against Samba 3.0.1 - 3.0.22
inclusive.  The bug is caused by continually increasing
the size of an array which maintains state information about
the number of active share connections.  The result is that
an attacker could cause a single smbd to bloat exhausting
the memory on a server.

Created an attachment (id=91012) [details]
tcon_DoS.patch

Christian do you think we should do some pretesting before the public release
or just wait?

I've done a quick test, but maybe I didn't understand the problem/patch.
With a loop like
'for n in ${long}; do smbmount //srv/share /mnt/point/${n} -o...; done'
I stop only at the memory limits of the client (well above 4000 concurrent
connections, instead of 2047 limit in the patch).
Is there anything more that I can do to test this?

*** Bug 139961 has been marked as a duplicate of this bug. ***

This is now public.

samba-3.0.22-r3 in portage, with patchset samba-3-gentoo-0.3.13.tar.bz2 in
/space/distfiles-local

Thx Christian.

Arches please test and mark stable.

ppc64 stable

1) emerges fine
2) no problems accessing shares from WinXP machine on Linux
3) no problems accessing shares of WinXP from Linux (through smp:// interface
of Nautilus and on command line via smbclient)

This is an partly unstable system:

Portage 2.1-r1 (default-linux/x86/2006.0, gcc-4.1.1, glibc-2.3.6-r4,
2.6.16-gentoo-r12 i686)
=================================================================
System uname: 2.6.16-gentoo-r12 i686 AMD Athlon(tm) XP 2500+
Gentoo Base System version 1.6.15
ccache version 2.3 [enabled]
app-admin/eselect-compiler: [Not Present]
dev-lang/python:     2.3.5-r2, 2.4.3-r1
dev-python/pycrypto: 2.0.1-r5
dev-util/ccache:     2.3
dev-util/confcache:  0.4.2
sys-apps/sandbox:    1.2.17
sys-devel/autoconf:  2.13, 2.59-r7
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2
sys-devel/binutils:  2.16.1-r3
sys-devel/gcc-config: 1.3.13-r3
sys-devel/libtool:   1.5.22
virtual/os-headers:  2.6.11-r2
ACCEPT_KEYWORDS="x86"
AUTOCLEAN="yes"
CBUILD="i686-pc-linux-gnu"
CFLAGS="-O2 -march=athlon-xp -pipe"
CHOST="i686-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/share/X11/xkb"
CONFIG_PROTECT_MASK="/etc/env.d /etc/gconf /etc/revdep-rebuild /etc/splash
/etc/terminfo"
CXXFLAGS="-O2 -march=athlon-xp -pipe"
DISTDIR="/usr/portage/distfiles"
FEATURES="autoconfig ccache confcache distlocks metadata-transfer
parallel-fetch sandbox sfperms strict"
GENTOO_MIRRORS="ftp://sunsite.informatik.rwth-aachen.de/pub/Linux/gentoo/"
LANG="de_DE@euro"
LC_ALL="de_DE@euro"
LINGUAS="de"
MAKEOPTS="-j2"
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress
--force --whole-file --delete --delete-after --stats --timeout=180
--exclude='/distfiles' --exclude='/local' --exclude='/packages'"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/local/portage"
SYNC="rsync://rsync.informatik.rwth-aachen.de/gentoo-portage"
USE="x86 3dnow 3dnowext X Xaw3d a52 alsa artworkextra asf audiofile avi
bash-completion beagle berkdb bidi bitmap-fonts bootsplash branding bzip2 cairo
ccache cdda cddb cdparanoia cdr cli cracklib crypt css cups curl custom-cflags
dbus dga directfb divx4linux dlloader dri dts dvd dvdr dvdread dvi eds emacs
emboss encode esd evo exif fam fat fbcon fdftk ffmpeg firefox foomaticdb
fortran ftp gb gcj gdbm gif gnome gpm gstreamer gtk gtk2 gtkhtml hal howl icq
idn imagemagick imap imlib ipv6 isdnlog java javascript jikes jpeg jpeg2k ldap
leim libg++ libwww lm_sensors mad maildir matroska mbox mikmod mime mmx mmxext
mng mono motif mp3 mpeg mpeg2 mule nautilus ncurses nforce2 nls nocardbus
nosendmail nowebdav nptl nptlonly nsplugin nvidia ogg opengl pam pcre pdf
pdflib perl plotutils pmu png ppds pppd preview-latex print python qt qt3 qt4
quicktime readline reflection reiserfs samba sdk session slang spell spl sse
ssl svg svga t1lib tcltk tcpd theora thunderbird tiff truetype truetype-fonts
type1-fonts udev usb vcd videos vorbis win32codecs wmf wxwindows xine xml xorg
xosd xv xvid zlib elibc_glibc input_devices_mouse input_devices_keyboard
kernel_linux linguas_de userland_GNU video_cards_radeon video_cards_vesa
video_cards_fbdev"
Unset:  CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LDFLAGS,
PORTAGE_RSYNC_EXTRA_OPTS

1) emerges fine
2) does not pass testsuite
make: *** No rule to make target `rpcclient/display.o', needed by
`bin/rpctorture'.  Stop.
[...]
 * rpctorture didn't build
running build
running build_py
running build_ext
>>> Source compiled.
 * Skipping make test/check due to ebuild restriction.

3) passes collision test

4) QA Notice: USE Flag 'kernel_linux' not in IUSE for net-fs/samba-3.0.22-r3

Portage 2.1-r1 (default-linux/x86/2006.0, gcc-3.4.6, glibc-2.3.6-r4,
2.6.16-gentoo-r12 i686)
=================================================================
System uname: 2.6.16-gentoo-r12 i686 AMD Athlon(tm) XP 2500+
Gentoo Base System version 1.6.15
app-admin/eselect-compiler: [Not Present]
dev-lang/python:     2.4.3-r1
dev-python/pycrypto: 2.0.1-r5
dev-util/ccache:     [Not Present]
dev-util/confcache:  [Not Present]
sys-apps/sandbox:    1.2.17
sys-devel/autoconf:  2.13, 2.59-r7
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2
sys-devel/binutils:  2.16.1-r3
sys-devel/gcc-config: 1.3.13-r3
sys-devel/libtool:   1.5.22
virtual/os-headers:  2.6.11-r2
ACCEPT_KEYWORDS="x86"
AUTOCLEAN="yes"
CBUILD="i686-pc-linux-gnu"
CFLAGS="-O0"
CHOST="i686-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/share/X11/xkb"
CONFIG_PROTECT_MASK="/etc/env.d /etc/gconf /etc/revdep-rebuild /etc/splash
/etc/terminfo"
CXXFLAGS="-O0"
DISTDIR="/usr/portage/distfiles"
FEATURES="autoconfig ccache collision-protect distlocks metadata-transfer
parallel-fetch sandbox sfperms strict test"
GENTOO_MIRRORS="ftp://sunsite.informatik.rwth-aachen.de/pub/Linux/gentoo/"
LANG="de_DE@euro"
LC_ALL="de_DE@euro"
LINGUAS="de"
MAKEOPTS="-j2"
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress
--force --whole-file --delete --delete-after --stats --timeout=180
--exclude='/distfiles' --exclude='/local' --exclude='/packages'"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/local/portage"
SYNC="rsync://rsync.informatik.rwth-aachen.de/gentoo-portage"
USE="x86 3dnow 3dnowext X Xaw3d a52 alsa apache2 arts artworkextra asf
audiofile avi bash-completion beagle berkdb bidi bitmap-fonts bootsplash
branding bzip2 cairo cdda cddb cdparanoia cdr cli cracklib crypt css cups curl
custom-cflags dbus dga directfb divx4linux dlloader dri dts dvd dvdr dvdread
dvi eds emacs emboss encode esd evo exif expat fam fat fbcon fdftk ffmpeg
firefox foomaticdb fortran ftp gb gcj gdbm gif gnome gpm gstreamer gtk gtk2
gtkhtml hal howl icq idn imagemagick imap imlib ipv6 isdnlog java javascript
jikes jpeg jpeg2k kde ldap leim libg++ libwww lm_sensors mad maildir matroska
mbox mikmod mime mmx mmxext mng mono motif mp3 mpeg mpeg2 mule nautilus ncurses
nforce2 nls nocardbus nowebdav nptl nptlonly nsplugin nvidia ogg opengl pam
pcre pdf pdflib perl plotutils pmu png ppds pppd preview-latex print python qt
qt3 qt4 quicktime readline reflection reiserfs samba sdk session slang spell
spl sse ssl svg svga t1lib tcltk tcpd theora thunderbird tiff truetype
truetype-fonts type1-fonts udev usb vcd videos vorbis win32codecs wmf wxwindows
xine xml xorg xosd xv xvid zlib elibc_glibc input_devices_mouse
input_devices_keyboard kernel_linux linguas_de userland_GNU video_cards_radeon
video_cards_vesa video_cards_fbdev"
Unset:  CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LDFLAGS,
PORTAGE_RSYNC_EXTRA_OPTS

ppc stable

x86 is done, the tests would be nice to pass though. Security comes first ~_~

Stable on SPARC

stable on amd64

Stable on hppa

Stable on alpha.

Marked stable on ia64 by agriffis.

This one is ready for GLSA decision. I tend to vote yes.

Hm, weak yes [I just think how winbindd eats memory in ADS mode in every single
version since 3.0.4 or so] :/

seems like a lot of distries issued an update for this one. and its very easy
to exploit ... mhh, another weak yes

Weak yes, lets have one

At last GLSA 200607-10.

arm and s390 don't forget to mark stable to benifit from the GLSA.

Does not affect current (2008.0) release. Removing release.