CVE-2014-3493: Buffer Overflow
It was discovered that smbd, the Samba file server deamon, did not properly handle certain valid on-disk unicode path names if an authenticated client tries to read them via a non-unicode request.
In case the pushascii() function encounters an error, e.g. a conversion failure, its error return value may incorrectly be used as a pointer in subsequent memory writes, leading to a crash or possible memory corruption.
Acknowledgments:
Red Hat would like to thank the Samba project for reporting this issue. The Samba project acknowledges Simon Arlott as the original reporter.
Other sources
The pushascii function in smbd in Samba 3.6.x before 3.6.24, 4.0.x before 4.0.19, and 4.1.x before 4.1.9 allows remote authenticated users to cause a denial of service (memory corruption and daemon crash) via an attempt to read a Unicode pathname without specifying use of Unicode, leading to a character-set conversion failure that triggers an invalid pointer dereference.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3493?
CVE-2014-3493 has been rated as having moderate severity due to its potential for denial of service conditions.
How do I fix CVE-2014-3493?
To fix CVE-2014-3493, update to a patched version of Samba that addresses the unicode path handling issue.
What versions of Samba are affected by CVE-2014-3493?
CVE-2014-3493 affects Samba versions from 3.6.0 through 4.1.8.
What kind of vulnerability is CVE-2014-3493?
CVE-2014-3493 is a vulnerability related to improper handling of unicode path names by the Samba file server daemon.
Can CVE-2014-3493 lead to data exposure?
CVE-2014-3493 primarily poses a risk of denial of service rather than data exposure.