CVE-2011-0719: Buffer Overflow
First published: Thu Feb 17 2011(Updated: )
A flaw was found in the way Samba handles the file descriptor sets (fd_set) datastructure. The Samba codebase uses file descriptor sets in various places. The fd_set structure is a fixed size defined by the FD_SETSIZE variable. If a file descriptor with a value greater than or equal to FD_SETSIZE is added to a set, it can set a single bit on the stack to a '1'. In Red Hat Enterprise Linux, all samba processes except for smbd have a limit set which prevents a process from allocating more than 1024 file descriptors by default. 1024 is the value of FD_SETSIZE on Red Hat Enterprise Linux. smbd does not cap the maximum allowed file descriptors below 1024. This means that if a remote attacker has the ability to open files on a Samba server, they may be able to flip arbitrary stack bits to a '1'. It is not currently believed that this flaw can be used for arbitrary code execution, but the possibility should not be ruled out. Acknowledgements: Red Hat would like to thank the Samba team for reporting this issue. Upstream acknowledges Volker Lendecke of SerNet as the original reporter.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Samba Samba | =3.0.19 | |
| Samba Samba | =3.0.23-c | |
| Samba Samba | =3.0.14a | |
| Samba Samba | =3.0.27 | |
| Samba Samba | =3.0.31 | |
| Samba Samba | =3.0.3 | |
| Samba Samba | =3.0.8 | |
| Samba Samba | =3.2.15 | |
| Samba Samba | =3.3.3 | |
| Samba Samba | =3.0.23-b | |
| Samba Samba | =3.0.29 | |
| Samba Samba | =3.0.25-pre2 | |
| Samba Samba | =3.0.25b | |
| Samba Samba | =3.2.5 | |
| Samba Samba | =3.2.3 | |
| Samba Samba | =3.0.2a | |
| Samba Samba | =3.0.36 | |
| Samba Samba | =3.0.28-a | |
| Samba Samba | =3.2.4 | |
| Samba Samba | =3.0.5 | |
| Samba Samba | =3.0.26-a | |
| Samba Samba | =3.3.9 | |
| Samba Samba | =3.0.21-a | |
| Samba Samba | =3.0.28 | |
| Samba Samba | =3.0.32 | |
| Samba Samba | =3.0.26a | |
| Samba Samba | =3.2.13 | |
| Samba Samba | =3.0.6 | |
| Samba Samba | =3.0.21a | |
| Samba Samba | =3.0.34 | |
| Samba Samba | =3.0.25-rc1 | |
| Samba Samba | =3.0.23 | |
| Samba Samba | =3.2.1 | |
| Samba Samba | =3.0.4-rc1 | |
| Samba Samba | =3.3.4 | |
| Samba Samba | =3.0.33 | |
| Samba Samba | =3.0.25-b | |
| Samba Samba | =3.0.21-b | |
| Samba Samba | =3.0.20a | |
| Samba Samba | =3.3.12 | |
| Samba Samba | =3.0.21b | |
| Samba Samba | =3.0.20-a | |
| Samba Samba | =3.3.7 | |
| Samba Samba | =3.0.0 | |
| Samba Samba | =3.0.9 | |
| Samba Samba | =3.2.9 | |
| Samba Samba | =3.0.11 | |
| Samba Samba | =3.0.7 | |
| Samba Samba | =3.0.13 | |
| Samba Samba | =3.3.1 | |
| Samba Samba | =3.2.2 | |
| Samba Samba | =3.2.7 | |
| Samba Samba | =3.0.14-a | |
| Samba Samba | =3.0.20b | |
| Samba Samba | =3.0.21-c | |
| Samba Samba | =3.0.16 | |
| Samba Samba | =3.2.10 | |
| Samba Samba | =3.0.17 | |
| Samba Samba | =3.0.21 | |
| Samba Samba | =3.0.26 | |
| Samba Samba | =3.0.14 | |
| Samba Samba | =3.0.25-pre1 | |
| Samba Samba | =3.0.30 | |
| Samba Samba | =3.0.21c | |
| Samba Samba | =3.3.11 | |
| Samba Samba | =3.0.20-b | |
| Samba Samba | =3.3.0 | |
| Samba Samba | =3.0.23b | |
| Samba Samba | =3.3.6 | |
| Samba Samba | =3.0.25-rc3 | |
| Samba Samba | =3.3.14 | |
| Samba Samba | =3.0.23-a | |
| Samba Samba | =3.0.2 | |
| Samba Samba | =3.0.12 | |
| Samba Samba | =3.2.12 | |
| Samba Samba | =3.0.37 | |
| Samba Samba | =3.0.20 | |
| Samba Samba | =3.2.8 | |
| Samba Samba | =3.0.35 | |
| Samba Samba | =3.0.18 | |
| Samba Samba | =3.0.23-d | |
| Samba Samba | =3.0.2-a | |
| Samba Samba | =3.0.25a | |
| Samba Samba | =3.0.25c | |
| Samba Samba | =3.3.2 | |
| Samba Samba | =3.0.24 | |
| Samba Samba | =3.0.10 | |
| Samba Samba | =3.2.11 | |
| Samba Samba | =3.1.0 | |
| Samba Samba | =3.0.27-a | |
| Samba Samba | =3.3.8 | |
| Samba Samba | =3.3.13 | |
| Samba Samba | =3.2.14 | |
| Samba Samba | =3.0.23d | |
| Samba Samba | =3.0.25-rc2 | |
| Samba Samba | =3.2.0 | |
| Samba Samba | =3.3.5 | |
| Samba Samba | =3.0.25-a | |
| Samba Samba | =3.0.23c | |
| Samba Samba | =3.0.15 | |
| Samba Samba | =3.2.6 | |
| Samba Samba | =3.0.23a | |
| Samba Samba | =3.0.25-c | |
| Samba Samba | =3.0.4 | |
| Samba Samba | =3.3.10 | |
| Samba Samba | =3.0.25 | |
| Samba Samba | =3.0.1 | |
| Samba Samba | =3.0.22 | |
| Samba Samba | =3.4.2 | |
| Samba Samba | =3.4.11 | |
| Samba Samba | =3.4.0 | |
| Samba Samba | =3.4.7 | |
| Samba Samba | =3.4.8 | |
| Samba Samba | =3.4.5 | |
| Samba Samba | =3.4.6 | |
| Samba Samba | =3.4.1 | |
| Samba Samba | =3.4.10 | |
| Samba Samba | =3.4.4 | |
| Samba Samba | =3.4.3 | |
| Samba Samba | =3.4.9 | |
| Samba Samba | =3.5.1 | |
| Samba Samba | =3.5.6 | |
| Samba Samba | =3.5.2 | |
| Samba Samba | =3.5.5 | |
| Samba Samba | =3.5.0 | |
| Samba Samba | =3.5.4 | |
| Samba Samba | =3.5.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=678328
- http://www.samba.org/samba/history/samba-3.4.12.html
- http://www.samba.org/samba/history/samba-3.5.7.html
- http://secunia.com/advisories/43512
- http://samba.org/samba/security/CVE-2011-0719.html
- http://www.samba.org/samba/history/samba-3.3.15.html
- http://www.redhat.com/support/errata/RHSA-2011-0305.html
- http://secunia.com/advisories/43482
- http://www.vupen.com/english/advisories/2011/0518
- http://www.redhat.com/support/errata/RHSA-2011-0306.html
- http://www.securityfocus.com/bid/46597
- http://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.593629
- http://secunia.com/advisories/43557
- http://www.debian.org/security/2011/dsa-2175
- http://www.vupen.com/english/advisories/2011/0541
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:038
- http://secunia.com/advisories/43503
- http://www.vupen.com/english/advisories/2011/0517
- http://www.vupen.com/english/advisories/2011/0519
- http://www.ubuntu.com/usn/USN-1075-1
- http://www.securitytracker.com/id?1025132
- http://www.vupen.com/english/advisories/2011/0520
- http://www.vupen.com/english/advisories/2011/0522
- http://secunia.com/advisories/43556
- http://secunia.com/advisories/43517
- http://secunia.com/advisories/43843
- http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056229.html
- http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056241.html
- http://www.vupen.com/english/advisories/2011/0702
- http://support.apple.com/kb/HT4723
- http://lists.apple.com/archives/security-announce/2011//Jun/msg00000.html
- http://marc.info/?l=bugtraq&m=130835366526620&w=2
- https://exchange.xforce.ibmcloud.com/vulnerabilities/65724
- http://samba.org/samba/history/samba-3.5.7.html
- https://rhn.redhat.com/errata/RHSA-2011-0305.html
- https://rhn.redhat.com/errata/RHSA-2011-0306.html
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=681852
- collector/nvd-historical
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/severity
- agent/weakness
- agent/references
- agent/last-modified-date
- agent/remedy
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2011-0719
- agent/tags
- agent/trending
- vendor/samba
- canonical/samba samba
- version/samba samba/3.0.19
- version/samba samba/3.0.23-c
- version/samba samba/3.0.14a
- version/samba samba/3.0.27
- version/samba samba/3.0.31
- version/samba samba/3.0.3
- version/samba samba/3.0.8
- version/samba samba/3.2.15
- version/samba samba/3.3.3
- version/samba samba/3.0.23-b
- version/samba samba/3.0.29
- version/samba samba/3.0.25-pre2
- version/samba samba/3.0.25b
- version/samba samba/3.2.5
- version/samba samba/3.2.3
- version/samba samba/3.0.2a
- version/samba samba/3.0.36
- version/samba samba/3.0.28-a
- version/samba samba/3.2.4
- version/samba samba/3.0.5
- version/samba samba/3.0.26-a
- version/samba samba/3.3.9
- version/samba samba/3.0.21-a
- version/samba samba/3.0.28
- version/samba samba/3.0.32
- version/samba samba/3.0.26a
- version/samba samba/3.2.13
- version/samba samba/3.0.6
- version/samba samba/3.0.21a
- version/samba samba/3.0.34
- version/samba samba/3.0.25-rc1
- version/samba samba/3.0.23
- version/samba samba/3.2.1
- version/samba samba/3.0.4-rc1
- version/samba samba/3.3.4
- version/samba samba/3.0.33
- version/samba samba/3.0.25-b
- version/samba samba/3.0.21-b
- version/samba samba/3.0.20a
- version/samba samba/3.3.12
- version/samba samba/3.0.21b
- version/samba samba/3.0.20-a
- version/samba samba/3.3.7
- version/samba samba/3.0.0
- version/samba samba/3.0.9
- version/samba samba/3.2.9
- version/samba samba/3.0.11
- version/samba samba/3.0.7
- version/samba samba/3.0.13
- version/samba samba/3.3.1
- version/samba samba/3.2.2
- version/samba samba/3.2.7
- version/samba samba/3.0.14-a
- version/samba samba/3.0.20b
- version/samba samba/3.0.21-c
- version/samba samba/3.0.16
- version/samba samba/3.2.10
- version/samba samba/3.0.17
- version/samba samba/3.0.21
- version/samba samba/3.0.26
- version/samba samba/3.0.14
- version/samba samba/3.0.25-pre1
- version/samba samba/3.0.30
- version/samba samba/3.0.21c
- version/samba samba/3.3.11
- version/samba samba/3.0.20-b
- version/samba samba/3.3.0
- version/samba samba/3.0.23b
- version/samba samba/3.3.6
- version/samba samba/3.0.25-rc3
- version/samba samba/3.3.14
- version/samba samba/3.0.23-a
- version/samba samba/3.0.2
- version/samba samba/3.0.12
- version/samba samba/3.2.12
- version/samba samba/3.0.37
- version/samba samba/3.0.20
- version/samba samba/3.2.8
- version/samba samba/3.0.35
- version/samba samba/3.0.18
- version/samba samba/3.0.23-d
- version/samba samba/3.0.2-a
- version/samba samba/3.0.25a
- version/samba samba/3.0.25c
- version/samba samba/3.3.2
- version/samba samba/3.0.24
- version/samba samba/3.0.10
- version/samba samba/3.2.11
- version/samba samba/3.1.0
- version/samba samba/3.0.27-a
- version/samba samba/3.3.8
- version/samba samba/3.3.13
- version/samba samba/3.2.14
- version/samba samba/3.0.23d
- version/samba samba/3.0.25-rc2
- version/samba samba/3.2.0
- version/samba samba/3.3.5
- version/samba samba/3.0.25-a
- version/samba samba/3.0.23c
- version/samba samba/3.0.15
- version/samba samba/3.2.6
- version/samba samba/3.0.23a
- version/samba samba/3.0.25-c
- version/samba samba/3.0.4
- version/samba samba/3.3.10
- version/samba samba/3.0.25
- version/samba samba/3.0.1
- version/samba samba/3.0.22
- version/samba samba/3.4.2
- version/samba samba/3.4.11
- version/samba samba/3.4.0
- version/samba samba/3.4.7
- version/samba samba/3.4.8
- version/samba samba/3.4.5
- version/samba samba/3.4.6
- version/samba samba/3.4.1
- version/samba samba/3.4.10
- version/samba samba/3.4.4
- version/samba samba/3.4.3
- version/samba samba/3.4.9
- version/samba samba/3.5.1
- version/samba samba/3.5.6
- version/samba samba/3.5.2
- version/samba samba/3.5.5
- version/samba samba/3.5.0
- version/samba samba/3.5.4
- version/samba samba/3.5.3