CNVD-2015-01174

Vulnerability from cnvd - Published: 2015-02-26
VLAI
Title
Samba任意代码执行漏洞
Description
Samba是在Linux和UNIX系统上实现SMB协议的一个免费软件，由服务器及客户端程序构成。它使用SMB/CIFS协议提供一个安全、稳定、快速的文件和打印服务，还可以无缝集成动态目录环境，可以作为域控制器以及一个域成员。 Samba存在任意代码执行漏洞，该漏洞产生的原因是Samba的守护进程smbd里的一个未初始化指针传递给TALLOC_FREE()功能存在缺陷，即通过使用一个空会话IPC，可以调用ServerPasswordSet RPC api NetLogon端点。允许攻击者通过一个恶意的Samba客户机，发送一个特定的netlogon数据包给smbd，获得smbd运行的root权限。
Severity
高
Patch Name
Samba任意代码执行漏洞的补丁
Patch Description
Samba是在Linux和UNIX系统上实现SMB协议的一个免费软件，由服务器及客户端程序构成。它使用SMB/CIFS协议提供一个安全、稳定、快速的文件和打印服务，还可以无缝集成动态目录环境，可以作为域控制器以及一个域成员。 Samba存在任意代码执行漏洞，该漏洞产生的原因是Samba的守护进程smbd里的一个未初始化指针传递给TALLOC_FREE()功能存在缺陷，即通过使用一个空会话IPC，可以调用ServerPasswordSet RPC api NetLogon端点。允许攻击者通过一个恶意的Samba客户机，发送一个特定的netlogon数据包给smbd，获得smbd运行的root权限。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description

目前厂商已经发布了补丁，请广大用户及时下载： http://www.samba.org/samba/security/

Reference
https://cxsecurity.com/cveshow/CVE-2015-0240/ https://www.samba.org/samba/security/CVE-2015-0240 https://securityblog.redhat.com/2015/02/23/samba-vulnerability-cve-2015-0240/
Impacted products
Name
Samba Samba 3.5.0-4.2.0rc4
Show details on source website
To clipboard 

{
  "bids": {
    "bid": {
      "bidNumber": "72711"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2015-0240"
    }
  },
  "description": "Samba\u662f\u5728Linux\u548cUNIX\u7cfb\u7edf\u4e0a\u5b9e\u73b0SMB\u534f\u8bae\u7684\u4e00\u4e2a\u514d\u8d39\u8f6f\u4ef6\uff0c\u7531\u670d\u52a1\u5668\u53ca\u5ba2\u6237\u7aef\u7a0b\u5e8f\u6784\u6210\u3002\u5b83\u4f7f\u7528SMB/CIFS\u534f\u8bae\u63d0\u4f9b\u4e00\u4e2a\u5b89\u5168\u3001\u7a33\u5b9a\u3001\u5feb\u901f\u7684\u6587\u4ef6\u548c\u6253\u5370\u670d\u52a1\uff0c\u8fd8\u53ef\u4ee5\u65e0\u7f1d\u96c6\u6210\u52a8\u6001\u76ee\u5f55\u73af\u5883\uff0c\u53ef\u4ee5\u4f5c\u4e3a\u57df\u63a7\u5236\u5668\u4ee5\u53ca\u4e00\u4e2a\u57df\u6210\u5458\u3002\r\n\r\nSamba\u5b58\u5728\u4efb\u610f\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u4ea7\u751f\u7684\u539f\u56e0\u662fSamba\u7684\u5b88\u62a4\u8fdb\u7a0bsmbd\u91cc\u7684\u4e00\u4e2a\u672a\u521d\u59cb\u5316\u6307\u9488\u4f20\u9012\u7ed9TALLOC_FREE()\u529f\u80fd\u5b58\u5728\u7f3a\u9677\uff0c\u5373\u901a\u8fc7\u4f7f\u7528\u4e00\u4e2a\u7a7a\u4f1a\u8bddIPC\uff0c\u53ef\u4ee5\u8c03\u7528ServerPasswordSet RPC api NetLogon\u7aef\u70b9\u3002\u5141\u8bb8\u653b\u51fb\u8005\u901a\u8fc7\u4e00\u4e2a\u6076\u610f\u7684Samba\u5ba2\u6237\u673a\uff0c\u53d1\u9001\u4e00\u4e2a\u7279\u5b9a\u7684netlogon\u6570\u636e\u5305\u7ed9smbd\uff0c\u83b7\u5f97smbd\u8fd0\u884c\u7684root\u6743\u9650\u3002",
  "discovererName": "Richard van Eeden of Microsoft Vulnerability Research",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u8865\u4e01\uff0c\u8bf7\u5e7f\u5927\u7528\u6237\u53ca\u65f6\u4e0b\u8f7d\uff1a\r\nhttp://www.samba.org/samba/security/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2015-01174",
  "openTime": "2015-02-26",
  "patchDescription": "Samba\u662f\u5728Linux\u548cUNIX\u7cfb\u7edf\u4e0a\u5b9e\u73b0SMB\u534f\u8bae\u7684\u4e00\u4e2a\u514d\u8d39\u8f6f\u4ef6\uff0c\u7531\u670d\u52a1\u5668\u53ca\u5ba2\u6237\u7aef\u7a0b\u5e8f\u6784\u6210\u3002\u5b83\u4f7f\u7528SMB/CIFS\u534f\u8bae\u63d0\u4f9b\u4e00\u4e2a\u5b89\u5168\u3001\u7a33\u5b9a\u3001\u5feb\u901f\u7684\u6587\u4ef6\u548c\u6253\u5370\u670d\u52a1\uff0c\u8fd8\u53ef\u4ee5\u65e0\u7f1d\u96c6\u6210\u52a8\u6001\u76ee\u5f55\u73af\u5883\uff0c\u53ef\u4ee5\u4f5c\u4e3a\u57df\u63a7\u5236\u5668\u4ee5\u53ca\u4e00\u4e2a\u57df\u6210\u5458\u3002\r\n\r\nSamba\u5b58\u5728\u4efb\u610f\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u4ea7\u751f\u7684\u539f\u56e0\u662fSamba\u7684\u5b88\u62a4\u8fdb\u7a0bsmbd\u91cc\u7684\u4e00\u4e2a\u672a\u521d\u59cb\u5316\u6307\u9488\u4f20\u9012\u7ed9TALLOC_FREE()\u529f\u80fd\u5b58\u5728\u7f3a\u9677\uff0c\u5373\u901a\u8fc7\u4f7f\u7528\u4e00\u4e2a\u7a7a\u4f1a\u8bddIPC\uff0c\u53ef\u4ee5\u8c03\u7528ServerPasswordSet RPC api NetLogon\u7aef\u70b9\u3002\u5141\u8bb8\u653b\u51fb\u8005\u901a\u8fc7\u4e00\u4e2a\u6076\u610f\u7684Samba\u5ba2\u6237\u673a\uff0c\u53d1\u9001\u4e00\u4e2a\u7279\u5b9a\u7684netlogon\u6570\u636e\u5305\u7ed9smbd\uff0c\u83b7\u5f97smbd\u8fd0\u884c\u7684root\u6743\u9650\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Samba\u4efb\u610f\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Samba Samba 3.5.0-4.2.0rc4"
  },
  "referenceLink": "https://cxsecurity.com/cveshow/CVE-2015-0240/\r\nhttps://www.samba.org/samba/security/CVE-2015-0240\r\nhttps://securityblog.redhat.com/2015/02/23/samba-vulnerability-cve-2015-0240/",
  "serverity": "\u9ad8",
  "submitTime": "2015-02-25",
  "title": "Samba\u4efb\u610f\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.