Samba Servers Vulnerability
Privacy and Legal Notice
INFORMATION BULLETIN
H-110: Samba Servers Vulnerability
September 30, 1997 18:00 GMT
PROBLEM: A vulnerability has been discovered in all versions of Samba.
PLATFORM: Servers running on Intel based platforms, specific to Intel
Linux servers.
DAMAGE: May allow unauthorized remote users to obtain root access.
SOLUTION: Samba version 1.9.17p2 is available from the ftp address
listed below.
VULNERABILITY An exploit for this security hole has been posted to the
ASSESSMENT: internet so system administrators should assume that this hole
is being actively exploited.
[ Start AUSCERT Advisory ]
------------------------------------------------------------------------------
From: Andrew Tridgell <tridge@samba.anu.edu.au>
Subject: Security bugfix for Samba
Date: Fri, 26 Sep 1997 23:48:49 +1000
Security bugfix for Samba
-------------------------
A security hole in all versions of Samba has been recently
discovered. The security hole allows unauthorized remote users to
obtain root access on the Samba server.
An exploit for this security hole has been posted to the internet so
system administrators should assume that this hole is being actively
exploited.
The exploit for the security hole is very architecture specific and
has been only demonstrated to work for Samba servers running on Intel
based platforms. The exploit posted to the internet is specific to
Intel Linux servers. It would be very difficult to produce an exploit
for other architectures but it may be possible.
A new release of Samba has now been made that fixes the security
hole. The new release is version 1.9.17p2 and is available from
ftp://samba.anu.edu.au/pub/samba/samba-1.9.17p2.tar.gz
This release also adds a routine which logs a message if anyone
attempts to take advantage of the security hole. The message (in the
Samba log files) will look like this:
ERROR: Invalid password length 999
your machine may be under attack by a user exploiting an old bug
Attack was from IP=aaa.bbb.ccc.ddd
where aaa.bbb.ccc.ddd is the IP address of the machine performing the attack.
Please report any attacks to the appropriate authority.
The Samba Team
samba-bugs@samba.anu.edu.au
------------------------------------------------------------------------------
[ End AUSCERT Advisory ]
CIAC wishes to acknowledge the contributions of AUSCERT & Andrew Tridgell (Samba) for the
information contained in this bulletin.
CIAC services are available to DOE, DOE Contractors, and the NIH. CIAC
can be contacted at:
Voice: +1 925-422-8193 (7 x 24)
FAX: +1 925-423-8002
STU-III: +1 925-423-2604
E-mail: ciac@ciac.org
World Wide Web: http://www.ciac.org/
Anonymous FTP: ftp.ciac.org
This document was prepared as an account of work sponsored by an
agency of the United States Government. Neither the United States
Government nor the University of California nor any of their
employees, makes any warranty, express or implied, or assumes any
legal liability or responsibility for the accuracy, completeness, or
usefulness of any information, apparatus, product, or process
disclosed, or represents that its use would not infringe privately
owned rights. Reference herein to any specific commercial products,
process, or service by trade name, trademark, manufacturer, or
otherwise, does not necessarily constitute or imply its endorsement,
recommendation or favoring by the United States Government or the
University of California. The views and opinions of authors expressed
herein do not necessarily state or reflect those of the United States
Government or the University of California, and shall not be used for
advertising or product endorsement purposes.
UCRL-MI-119788
[Privacy and Legal Notice]