CVE-2011-0719: Buffer Overflow
A flaw was found in the way Samba handles the file descriptor sets (fdset) datastructure.
The Samba codebase uses file descriptor sets in various places. The fdset structure is a fixed size defined by the FDSETSIZE variable. If a file descriptor with a value greater than or equal to FDSETSIZE is added to a set, it can set a single bit on the stack to a '1'.
In Red Hat Enterprise Linux, all samba processes except for smbd have a limit set which prevents a process from allocating more than 1024 file descriptors by default. 1024 is the value of FDSETSIZE on Red Hat Enterprise Linux.
smbd does not cap the maximum allowed file descriptors below 1024. This means that if a remote attacker has the ability to open files on a Samba server, they may be able to flip arbitrary stack bits to a '1'. It is not currently believed that this flaw can be used for arbitrary code execution, but the possibility should not be ruled out.
Acknowledgements:
Red Hat would like to thank the Samba team for reporting this issue. Upstream acknowledges Volker Lendecke of SerNet as the original reporter.
Other sources
Samba 3.x before 3.3.15, 3.4.x before 3.4.12, and 3.5.x before 3.5.7 does not perform range checks for file descriptors before use of the FDSET macro, which allows remote attackers to cause a denial of service (stack memory corruption, and infinite loop or daemon crash) by opening a large number of files, related to (1) Winbind or (2) smbd.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-0719?
CVE-2011-0719 has a medium severity rating due to the potential for denial of service.
How do I fix CVE-2011-0719?
To fix CVE-2011-0719, upgrade your Samba version to one that addresses this vulnerability, specifically versions later than 3.4.12.
What types of software are affected by CVE-2011-0719?
CVE-2011-0719 affects various versions of Samba, specifically versions from 3.0.0 through 3.5.6.
Can CVE-2011-0719 be exploited remotely?
Yes, CVE-2011-0719 can potentially be exploited remotely, which could lead to a denial of service.
Is CVE-2011-0719 related to file descriptor handling?
Yes, CVE-2011-0719 is specifically related to how Samba handles the file descriptor sets (fd_set) data structure.