OpenPKG Security Advisory

Publisher Name:          OpenPKG GmbH
Publisher Home:          http://openpkg.com/

Advisory Id (public):    OpenPKG-SA-2004.040
Advisory Type:           OpenPKG Security Advisory (SA)
Advisory Directory:      http://openpkg.com/go/OpenPKG-SA
Advisory Document:       http://openpkg.com/go/OpenPKG-SA-2004.040
Advisory Published:      2010-02-09 16:47 UTC

Issue Id (internal):     OpenPKG-SI-20040915.01
Issue First Created:     2004-09-15
Issue Last Modified:     2006-11-28
Issue Revision:          07


Subject Name:            Samba
Subject Summary:         SMB/CIFS Server
Subject Home:            http://www.samba.org/
Subject Versions:        * <= 3.0.6

Vulnerability Id:        CVE-2004-0807, CVE-2004-0808
Vulnerability Scope:     global (not OpenPKG specific)

Attack Feasibility:      run-time
Attack Vector:           remote network
Attack Impact:           denial of service

Description:
    According to a security advisory [1] from the Samba team and two
    corresponding security advisories [2][3] from iDEFENSE, two Denial of
    Service (DoS) vulnerabilities exists in the Samba SMB/CIFS server [0].
    The first DoS bug is in smbd(8) and may allow an unauthenticated user
    to cause smbd(8) to spawn new processes, each one entering an infinite
    loop. After sending a sufficient amount of packets it is possible to
    exhaust the memory resources on the server. The second DoS bug in
    nmbd(8) may allow an attacker to remotely crash the nmbd(8) daemon.

References:
    [0]  http://www.samba.org/
    [1]  http://us3.samba.org/samba/history/3.0_DOS_sept04_announce.txt
    [2]  http://www.idefense.com/application/poi/display?id=138
    [3]  http://www.idefense.com/application/poi/display?id=139
    [4]  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0807
    [5]  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0808
    [6]  http://www.openpkg.org/tutorial.html#regular-source
    [7]  http://www.openpkg.org/tutorial.html#regular-binary
    [8]  ftp://ftp.openpkg.org/release/2.1/UPD/samba-3.0.4-2.1.2.src.rpm
    [9]  ftp://ftp.openpkg.org/release/2.1/UPD/
    [10] http://www.openpkg.org/security.html#signature


Primary Package Name:    samba
Primary Package Home:    http://openpkg.org/go/package/samba

Affected Distribution:   Affected Branch:  Affected Package:
OpenPKG Community        2.0-SOLID         n/a
OpenPKG Community        2.1-SOLID         samba-3.0.4-2.1.1
OpenPKG Community        CURRENT           samba-3.0.6-20040820

Corrected Distribution:  Corrected Branch: Corrected Package:
OpenPKG Community        2.0-SOLID         n/a
OpenPKG Community        2.1-SOLID         samba-3.0.4-2.1.2
OpenPKG Community        CURRENT           samba-3.0.7-20040913