From: "Gerald (Jerry) Carter" <jerry@samba.org>
User-Agent: Thunderbird 1.5.0.10 (X11/20070403)
To: vendor-sec@lst.de
Cc: security@samba.org, vendor-disclosure@idefense.com
Subject: [vendor-sec] [Samba] Remote Command Injection Vulnerability
Errors-To: vendor-sec-admin@lst.de
Date: Thu, 10 May 2007 15:03:08 -0500

[-- Anhang #1 --]
[-- Typ: text/plain, Kodierung: 7bit, Größe: 2,9K --]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

==========================================================
==
== Subject:     Unescaped user input parameters are passed
==              as arguments to /bin/sh allowing for remote
==              command execution
== CVE ID#:     CVE-2007-2447
==
== Versions:    Samba 3.0.0 - 3.0.25rc3 (inclusive)
==
== Summary:
==
==========================================================

===========
Description
===========

This bug was originally reported against the anonymous calls
to the SamrChangePassword() MS-RPC function in combination
with the "username map script" smb.conf option (which is not
enabled by default).

After further investigation by Samba developers, it was
determined that the problem was much broader and impacts
remote printer and file share management as well.  The root
cause is passing unfiltered user input provided via MS-RPC
calls to /bin/sh when invoking externals scripts defined
in smb.conf.  However, unlike the "username map script"
vulnerability, the remote file and printer management scripts
require an authenticated user session.


==================
Patch Availability
==================

A patch against Samba 3.0.24 has been attached to
this email.  At the time of public disclosure, the patch
will be posted to http://www.samba.org/samba/security/.
Back ports of the patch to to Samba 2.2.12, 3.0.9, and
3.0.10 are available upon request thanks to Samba/RedHat
developer Simo Sorce <idra@samba.org>.


==========
Workaround
==========

This defect may be alleviated by removing all defined
external script invocations (username map script, add
printer command, etc...) from smb.conf.

The Samba Team always encourages users to run the latest
stable release as a defense against attacks.  If this
is not immediately possible, administrators should read
the "Server Security" documentation found at

  http://www.samba.org/samba/docs/server_security.html


=======
Credits
=======

This vulnerability was reported to Samba developers by
Joshua J. Drake, iDefense Labs (http://www.idefense.com/),  
as part of their Vulnerability Contributor Program.

The time line is as follows:

* May 7, 2007: Initial defect disclosure to the security@samba.org
  email alias.
* May 7, 2007: Initial developer response by Samba
  developer Gerald Carter.
* May 9, 2007: Patch released by Samba developer Jeremy Allison
  to iDefense for testing.
* May 10, Announcement to vendor-sec mailing list
* May 14, 2007: Proposed date for public announcement of the
  security issue. 




==========================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
==========================================================
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFGQ3p8IR7qMdg1EfYRAqcLAKDYq/VbQuCUpMZuBBRYJ+YLXqoiiACfV1zo
qJKbGwSYpnKHXSmnV/YeyIg=
=0eBX
-----END PGP SIGNATURE-----