Samba Multiple Remote Denial of Service Vulnerabilities

Bugtraq ID:	40097
Class:	Unknown
CVE:	CVE-2010-1635 CVE-2010-1642
Remote:	Yes
Local:	No
Published:	May 11 2010 12:00AM
Updated:	Jun 25 2012 12:50PM
Credit:	Laurent Gaffie
Vulnerable:	Samba Samba 3.5.1 Samba Samba 3.4.7 Samba Samba 3.4.6 Samba Samba 3.4.5 Samba Samba 3.4.2 Samba Samba 3.4.1 Samba Samba 3.5 Pardus Linux 2009 0 Mandriva Linux Mandrake 2010.0 x86_64 Mandriva Linux Mandrake 2010.0 Gentoo Linux
Not Vulnerable:	Samba Samba 3.5.2 Samba Samba 3.4.8

Samba Multiple Remote Denial of Service Vulnerabilities

Samba is prone to multiple remote denial-of-service vulnerabilities.

An attacker can exploit these issues to crash the application, denying service to legitimate users.

Versions prior to Samba 3.4.8 and 3.5.2 are vulnerable.

Samba Multiple Remote Denial of Service Vulnerabilities

The following exploits are available:

• /data/vulnerabilities/exploits/40097-2.py
• /data/vulnerabilities/exploits/40097-1.py

Samba Multiple Remote Denial of Service Vulnerabilities

Solution:
Updates are available. Please see the references for more information.


Mandriva Linux Mandrake 2010.0 x86_64

• Mandriva lib64netapi-devel-3.4.8-0.1mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64netapi0-3.4.8-0.1mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64smbclient0-3.4.8-0.1mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64smbclient0-devel-3.4.8-0.1mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64smbclient0-static-devel-3.4.8-0.1mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64smbsharemodes-devel-3.4.8-0.1mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64smbsharemodes0-3.4.8-0.1mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64wbclient-devel-3.4.8-0.1mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64wbclient0-3.4.8-0.1mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva mount-cifs-3.4.8-0.1mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva nss_wins-3.4.8-0.1mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva samba-client-3.4.8-0.1mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva samba-common-3.4.8-0.1mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva samba-doc-3.4.8-0.1mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva samba-server-3.4.8-0.1mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva samba-swat-3.4.8-0.1mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva samba-winbind-3.4.8-0.1mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2010.0

• Mandriva libnetapi-devel-3.4.8-0.1mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libnetapi0-3.4.8-0.1mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libsmbclient0-3.4.8-0.1mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libsmbclient0-devel-3.4.8-0.1mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libsmbclient0-static-devel-3.4.8-0.1mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libsmbsharemodes-devel-3.4.8-0.1mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libsmbsharemodes0-3.4.8-0.1mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libwbclient-devel-3.4.8-0.1mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libwbclient0-3.4.8-0.1mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva mount-cifs-3.4.8-0.1mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva nss_wins-3.4.8-0.1mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva samba-client-3.4.8-0.1mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva samba-common-3.4.8-0.1mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva samba-doc-3.4.8-0.1mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva samba-server-3.4.8-0.1mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva samba-swat-3.4.8-0.1mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva samba-winbind-3.4.8-0.1mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/

Samba Multiple Remote Denial of Service Vulnerabilities

References:

• An uninitialized variable read could cause an smbd crash. (Samba)
  
• Release Notes for Samba 3.4.8 (Samba)
  
• Release Notes for Samba 3.5.2 (Samba)
  
• Samba Homepage (Samba)