Advisory Details

April 18th, 2012

Samba NDR PULL SVCCTL StartServiceW Heap Overflow Remote Code Execution Vulnerability

ZDI-12-063
ZDI-CAN-1537

CVE ID CVE-2012-1182
CVSS SCORE 10, (AV:N/AC:L/Au:N/C:C/I:C/A:C)
AFFECTED VENDORS Samba
AFFECTED PRODUCTS 3.6.x
TREND MICRO CUSTOMER PROTECTION Trend Micro TippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID 12224. For further product information on the TippingPoint IPS: http://www.tippingpoint.com
VULNERABILITY DETAILS


This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samba. Authentication is not required to exploit this vulnerability.

The specific flaw exists within Samba's handling of a NDR PULL SVCCTL StartServiceW request. By sending a specially crafted packet, it is possible to cause Samba to use a different size for memory allocation than it uses for a memory copy loop. This can result in memory corruption, and may be exploited by an attacker to gain remote code execution.

ADDITIONAL DETAILS Samba has issued an update to correct this vulnerability. More details can be found at:
http://www.samba.org/samba/security/CVE-2012-1182
DISCLOSURE TIMELINE
  • 2011-10-20 - Vulnerability reported to vendor
  • 2012-04-18 - Coordinated public release of advisory
CREDIT Anonymous
BACK TO ADVISORIES