client/mount.cifs.c in mount.cifs in smbfs in Samba 3.4.5 and earlier does not verify that the (1) device name and (2) mountpoint strings are composed of valid characters, which allows local users to cause a denial of service (mtab corruption) via a crafted string.
+++ This bug was initially created as a clone of Bug #532940 +++
Several race condition flaws were found in samba-client, fuse and ncpfs packages:
a, Ronald Volgers found a race condition in the samba-client's mount.cifs utility. Local, unprivileged user could use this flaw to conduct symlink attacks, leading to disclosure of sensitive information, or, possibly to privilege escalation.
Upstream bug report: https://bugzilla.samba.org/showbug.cgi?id=6853
Upstream Samba patches: http://git.samba.org/?p=samba.git;a=commit;h=3ae5dac462c4ed0fb2cd94553583c56fce2f9d80 http://git.samba.org/?p=samba.git;a=commit;h=a065c177dfc8f968775593ba00dffafeebb2e054 http://git.samba.org/?p=samba.git;a=commit;h=a0c31ec1c8d1220a5884e40d9ba6b191a04a24d5
Issue severity note for Red Hat Enteprise Linux: ------------------------------------------------
The mount.cifs binary, as shipped within samba-client package on Red Hat Enterprise Linux 4 and 5, is NOT shipped with setuid root bit enabled by default (local, unprivileged users on these systems are NOT able to mount custom CIFS filesystem shares), which mitigates the impact of the vulnera- bility.
b, Dan Rosenberg found a race condition in the FUSE's fusermount's utility by performing FUSE filesystem(s) unmount operation (it was not performed atomically). A local, unprivileged user could use this flaw to cause a denial of service (unprivileged unmount of FUSE filesystem share(s) owned by privileged user) via symlink attack involving FUSE share(s) belonging to privileged user.
Issue severity note for Red Hat Enterprise Linux: -------------------------------------------------
The "fusermount" utility, as shipped within "fuse" package in Red Hat Enterprise Linux 5 IS shipped with setuid root bit enabled by default, but the unprivileged user to be able to mount custom FUSE filesystem, he needs prior to be the member of special "fuse" users group (user membership in this group is granted by privileged user), which mitigates the impact of the vulnerability.
c, Dan Rosenberg found race conditions in the ncpfs ncpmount and ncpumount utilities. Local, unprivileged user could use these flaws to conduct symlink attacks, leading to denial of service (ncpumount), disclosure of sensitive information, or, possibly to privilege escalation (ncpmount).
Issue severity note for Fedora: -------------------------------
The "ncpmount and ncpumount" utilities, as shipped within "ncpfs" package in Fedora release of 11 and 12 are NOT shipped with setuid root bit enabled by default (unprivileged, local users are NOT able to mount / umount custom remote NCP shares), which mitigates the impact of the flaws.
MITRE has rejected the use of CVE-2009-3297 because it was used for samba, ncpfs, and fuse when it should only have been used for Samba.
Instead, new CVEs have been assigned as follows:
CVE-2010-0787: samba CVE-2010-0788: ncpfs CVE-2010-0789: fuse
This issue does not affect Red Hat Enterprise Linux 4 and 5 by default as mount.cifs is not provided with the setuid bit enabled. If a user has turned on the setuid bit (via 'chmod +s /sbin/mount.cifs'), they would be affected by this issue and can workaround the problem by removing the setuid bit.
Red Hat Enterprise Linux 3 does not provide the mount.cifs program.
The Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw. More information regarding issue severity can be found here:
http://www.redhat.com/security/updates/classification/
The smdb daemon (smbd/service.c) in Samba 3.0.1 through 3.0.22 allows remote attackers to cause a denial of service (memory consumption) via a large number of share connection requests.
Stack-based buffer overflow in the sendmailslot function in nmbd in Samba 3.0.0 through 3.0.27a, when the "domain logons" option is enabled, allows remote attackers to execute arbitrary code via a GETDC mailslot request composed of a long GETDC string following an offset username in a SAMLOGON logon request.
Stack-based buffer overflow in the replynetbiospacket function in nmbd/nmbdpackets.c in nmbd in Samba 3.0.0 through 3.0.26a, when operating as a WINS server, allows remote attackers to execute arbitrary code via crafted WINS Name Registration requests followed by a WINS Name Query request.
Stack-based buffer overflow in nmbd in Samba 3.0.0 through 3.0.26a, when configured as a Primary or Backup Domain controller, allows remote attackers to have an unknown impact via crafted GETDC mailslot requests, related to handling of GETDC logon server requests.
Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum (netdfsiodfsEnumInfod), (2) RFNPCNEX (smbionotifyoptiontypedata), (3) LsarAddPrivilegesToAccount (lsaioprivilegeset), (4) NetSetFileSecurity (secioacl), or (5) LsarLookupSids/LsarLookupSids2 (lsaiotransnames).
Format string vulnerability in the afsacl.so VFS module in Samba 3.0.6 through 3.0.23d allows context-dependent attackers to execute arbitrary code via format string specifiers in a filename on an AFS file system, which is not properly handled during Windows ACL mapping.
Buffer overflow in the nsswinbind.so.1 library in Samba 3.0.21 through 3.0.23d, as used in the winbindd daemon on Solaris, allows attackers to execute arbitrary code via the (1) gethostbyname and (2) getipnodebyname functions.
smbd in Samba 3.0.6 through 3.0.23d allows remote authenticated users to cause a denial of service (memory and CPU exhaustion) by renaming a file in a way that prevents a request from being removed from the deferred open queue, which triggers an infinite loop.
An integer overflow flaw was found in the way samba read an EA list provided by the client. A malicious client could send a specially crafted EA list that wraps perfectly on a 32-bit boundary, causing the server to loop and re-process the list. This can cause Denial of Service via memory exhaustion.
Reference:
https://bugzilla.samba.org/showbug.cgi?id=10010 (curently private)