Bug 356917 – <net-fs/samba-{3.4.12,3.5.7}: Stack corruption denial of service vulnerability (CVE-2011-0719)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Tim Sammut (RETIRED) 2011-03-01 03:55:14 UTC]

From $URL:

All current released versions of Samba are vulnerable to
a denial of service caused by memory corruption. Range
checks on file descriptors being used in the FD_SET macro
were not present allowing stack corruption. This can cause
the Samba code to crash or to loop attempting to select
on a bad file descriptor set.

A connection to a file share, or a local account is needed
to exploit this problem, either authenticated or unauthenticated
(guest connection).

[Comment 1 Tim Sammut (RETIRED) 2011-03-02 07:33:17 UTC]

*** Bug 357061 has been marked as a duplicate of this bug. ***

[Comment 2 Patrick Lauer 2011-03-02 10:58:17 UTC]

+*samba-3.5.7 (02 Mar 2011)
+
+  02 Mar 2011; Patrick Lauer <[e-mail]> +samba-3.5.7.ebuild:
+  Bump for #356917

ebuilds in tree.

[Comment 3 Mike Limansky 2011-03-02 11:35:10 UTC]

(In reply to comment #2)
> +*samba-3.5.7 (02 Mar 2011)
> +
> +  02 Mar 2011; Patrick Lauer <[e-mail]> +samba-3.5.7.ebuild:
> +  Bump for #356917
> 
> ebuilds in tree.
> 

Could you please also provide ebuild for samba-3.4.12 which contains fix for the same issue for 3.4 branch? http://samba.org/samba/latest_news.html#3.4.12

[Comment 4 Víctor Ostorga (RETIRED) 2011-03-02 20:42:30 UTC]

@security : I've added samba-3.4.12 ebuild to the tree which fixes this issue. Please proceed with the stabilization of samba-3.4.12
Target keywords: alpha amd64 arm hppa ia64 ppc ppc64 s390 sh sparc x86

[Comment 5 Tim Sammut (RETIRED) 2011-03-03 07:16:10 UTC]

(In reply to comment #4)
> @security : I've added samba-3.4.12 ebuild to the tree which fixes this issue.
> Please proceed with the stabilization of samba-3.4.12
> Target keywords: alpha amd64 arm hppa ia64 ppc ppc64 s390 sh sparc x86
> 

Great, thank you.

Arches, please test and mark stable:
=net-fs/samba-3.4.12
Target keywords : "alpha amd64 arm hppa ia64 ppc ppc64 s390 sh sparc x86"

[Comment 6 Agostino Sarubbo 2011-03-03 11:36:22 UTC]

amd64 ok

[Comment 7 Andreas Schürch 2011-03-04 06:55:10 UTC]

Looks good here on x86.

[Comment 8 Jeroen Roovers (RETIRED) 2011-03-04 15:46:06 UTC]

Stable for HPPA.

[Comment 9 Markos Chandras (RETIRED) 2011-03-04 19:22:42 UTC]

amd64 done. Thanks Agostino

[Comment 10 Alex Buell 2011-03-04 22:44:38 UTC]

I was only able to see if it compiled OK on SPARC, thats all I was able to do, not having any use for SAMBA unfortunately. 

[Comment 11 Kacper Kowalik (Xarthisius) (RETIRED) 2011-03-05 09:47:05 UTC]

ppc/ppc64 stable

[Comment 12 Raúl Porcel (RETIRED) 2011-03-05 13:46:10 UTC]

alpha/arm/ia64/s390/sh/sparc/x86 stable

[Comment 13 Tim Sammut (RETIRED) 2011-03-05 21:18:53 UTC]

Thanks, everyone. Added to existing GLSA request.

[Comment 14 GLSAMaker/CVETool Bot 2011-06-24 20:01:18 UTC]

CVE-2011-0719 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0719):
  Samba 3.x before 3.3.15, 3.4.x before 3.4.12, and 3.5.x before 3.5.7 does
  not perform range checks for file descriptors before use of the FD_SET
  macro, which allows remote attackers to cause a denial of service (stack
  memory corruption, and infinite loop or daemon crash) by opening a large
  number of files, related to (1) Winbind or (2) smbd.

[Comment 15 GLSAMaker/CVETool Bot 2012-06-24 13:05:26 UTC]

This issue was resolved and addressed in
 GLSA 201206-22 at http://security.gentoo.org/glsa/glsa-201206-22.xml
by GLSA coordinator Sean Amoss (ackle).