Users login

Create an account »

JOIN XATRIX

Users login

Home » Hacking News » Gentoo 200309-01: pam_smb buffer overflow

Gentoo 200309-01: pam_smb buffer overflow

by Nikola Strahija on September 1st, 2003 A buffer overflow has been found that affects unpatched versions of pam_smb up to and including 1.1.6. On systems that use pam_smb and are configured to authenticate a remotely accessible service, an attacker can exploit this bug and remotely execute arbitrary code.


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - - ---------------------------------------------------------------------
GENTOO LINUX SECURITY ANNOUNCEMENT 200309-01
- - - ---------------------------------------------------------------------

PACKAGE : pam_smb
SUMMARY : buffer overflow
DATE : 2003-09-01 12:12 UTC
EXPLOIT : remote
VERSIONS AFFECTED : FIXED VERSION : >=pam_smb-2.0.0_rc5
CVE : CAN-2003-0686

- - - ---------------------------------------------------------------------

quote from Debian DSA-374-1:

"If a long password is supplied, this can cause a buffer overflow which
could be exploited to execute arbitrary code with the privileges of the
process which invokes PAM services."

SOLUTION

It is recommended that all Gentoo Linux users who are running
net-misc/pam_smb upgrade to pam_smb-2.0.0_rc5 as follows

emerge sync
emerge pam_smb
emerge clean

- - - ---------------------------------------------------------------------
[email protected] - GnuPG key is available at http://dev.gentoo.org/~aliz
- - - ---------------------------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)

iD8DBQE/UzfHfT7nyhUpoZMRAn0+AJ9G7Fz+C24SgDhG+7ttu9uaMVSdjwCeOXvJ
1essxpePeyawnfuixgUkaeg=
=nlva
-----END PGP SIGNATURE-----


Newsletter signup

Signup to our monthly newsletter and stay in touch with IT news!

Free E-books

We've got ebooks! But they're not online. :( Please give us a few days to bring downloads back.

Contact

Have something to say or just wanna drop us a line? Please keep this in mind: to spam, we reply with spam.

Contact us »