Don't Bypass The Samba Security Bypass Vulnerability

It doesn't rain but it storms, this saying relates very well to the world of computer security, which is no exception to this rule. Not one but two vulnerabilities have been reported in Samba. The slogan of Samba is: opening Windows to a wider world. Samba is not only open source but is also free software that gives specific seamless print and file services to its clients.

Samba is able to run on various platforms with the inclusion of UNIX, linux, OpenVMS as well as the majority of the Microsoft Windows versions. Some of the files of the widely used Windows Vista may include but are by no means limited to the following: xmllite.dll, wsupgrade.dll, wmimigrationplugin.dll, winsetup.dll, wininetplugin.dll as well as win32ui.dll.

The two vulnerabilities which have been located in Samba:

1. A particular format string error has been found in the "smbclient" utility. This happens when the processing of file names occurs. This may be exploited which will result in the execution of arbitrary code.
2. There is an uninitialized memory access error in the smbd when the denying of attempts to change the restricted access control list (ACL), takes place. This error may be exploited in order to change the ACL of a file that is already writable, without obtaining permission.

With regard to the uninitialized memory access error, it is vital for users to understand that in order for this vulnerability to be exploited successfully, "something needs to happen". This "something" that needs to happen, is that it is required that "dos file mode" is set to "yes" in smb.conf. The impact of both of these vulnerabilities includes unauthorized system access as well as security bypassing.

Both of these vulnerabilities have luckily been rated as less critical. This does not mean that users shouldn't take it seriously and take the necessary precautions. The solution to these vulnerabilities is to apply the relevant patches. With regard to the uninitialized memory access error, the vulnerability pertains to versions 3.0.31 through to 3.3.5. With regard to the format string error, the vulnerability pertains to versions 3.2.0 through to 3.2.12. The ultimate solution is to Update to versions 3.0.35, 3.2.13, or alternatively versions 3.3.6.