[ GLSA 200903-07 ] Samba: Data disclosure

[GLSA]

Gentoo Linux Security Advisory

Title: Samba: Data disclosure (GLSA 200903-07)
Severity: normal
Exploitable: remote
Date: March 07, 2009
Bug(s): #247620
ID: 200903-07

Synopsis

A missing boundary check in Samba might lead to the disclosure of memory contents.

Background

Samba is a suite of SMB and CIFS client/server programs.

Affected Packages

Package: net-fs/samba
Vulnerable: < 3.0.33
Unaffected: >= 3.0.33
Architectures: All supported architectures


Description

Samba does not properly check memory boundaries when handling trans, rans2, and nttrans requests.

Impact

A remote attacker could send specially crafted requests to a Samba daemon, leading to the disclosure of arbitrary memory or to a Denial of Service.

Workaround

There is no known workaround at this time.

Resolution

All Samba users should upgrade to the latest version: