FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The last vuln.xml file processed by FreshPorts is:

nothing found there

List all Vulnerabilities, by package

List all Vulnerabilities, by date

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
b168ddea-105a-11db-ac96-000c6ec775d9samba -- memory exhaustion DoS in smbd

The Samba Team reports:

The smbd daemon maintains internal data structures used track active connections to file and printer shares. In certain circumstances an attacker may be able to continually increase the memory usage of an smbd process by issuing a large number of share connection requests. This defect affects all Samba configurations.

Discovery 2006-07-10
Entry 2006-07-10
ge 3.0.1,1 lt 3.0.23,1

3546a833-03ea-11dc-a51d-0019b95d4f14samba -- multiple vulnerabilities

The Samba Team reports:

A bug in the local SID/Name translation routines may potentially result in a user being able to issue SMB/CIFS protocol operations as root.

When translating SIDs to/from names using Samba local list of user and group accounts, a logic error in the smbd daemon's internal security stack may result in a transition to the root user id rather than the non-root user. The user is then able to temporarily issue SMB/CIFS protocol operations as the root user. This window of opportunity may allow the attacker to establish additional means of gaining root access to the server.

Various bugs in Samba's NDR parsing can allow a user to send specially crafted MS-RPC requests that will overwrite the heap space with user defined data.

Unescaped user input parameters are passed as arguments to /bin/sh allowing for remote command execution.

This bug was originally reported against the anonymous calls to the SamrChangePassword() MS-RPC function in combination with the "username map script" smb.conf option (which is not enabled by default).

After further investigation by Samba developers, it was determined that the problem was much broader and impacts remote printer and file share management as well. The root cause is passing unfiltered user input provided via MS-RPC calls to /bin/sh when invoking externals scripts defined in smb.conf. However, unlike the "username map script" vulnerability, the remote file and printer management scripts require an authenticated user session.

Discovery 2007-05-14
Entry 2007-05-16
Modified 2008-09-26
gt 3.* lt 3.0.25

gt 3.*,1 lt 3.0.25,1

f235fe7a-b9ca-11db-bf0f-0013720b182dsamba -- potential Denial of Service bug in smbd

The Samba Team reports:

Internally Samba's file server daemon, smbd, implements support for deferred file open calls in an attempt to serve client requests that would otherwise fail due to a share mode violation. When renaming a file under certain circumstances it is possible that the request is never removed from the deferred open queue. smbd will then become stuck is a loop trying to service the open request.

This bug may allow an authenticated user to exhaust resources such as memory and CPU on the server by opening multiple CIFS sessions, each of which will normally spawn a new smbd process, and sending each connection into an infinite loop.

Discovery 2007-02-05
Entry 2007-03-16
ge 3.0.6,1 lt 3.0.24,1

3b3676be-52e1-11d9-a9e7-0001020eed82samba -- integer overflow vulnerability

Greg MacManus, iDEFENSE Labs reports:

Remote exploitation of an integer overflow vulnerability in the smbd daemon included in Samba 2.0.x, Samba 2.2.x, and Samba 3.0.x prior to and including 3.0.9 could allow an attacker to cause controllable heap corruption, leading to execution of arbitrary commands with root privileges.

Successful remote exploitation allows an attacker to gain root privileges on a vulnerable system. In order to exploit this vulnerability an attacker must possess credentials that allow access to a share on the Samba server. Unsuccessful exploitation attempts will cause the process serving the request to crash with signal 11, and may leave evidence of an attack in logs.

Discovery 2004-12-02
Entry 2004-12-21
Modified 2008-09-26
lt 3.0.10

gt *,1 lt 3.0.10,1

lt 2.2.12.j1.0beta1_2

gt 3.* lt 3.0.10

gt 3.*,1 lt 3.0.10,1

ba13dc13-340d-11d9-ac1b-000d614f7fadsamba -- potential remote DoS vulnerability

Karol Wiesek at iDEFENSE reports:

A remote attacker could cause an smbd process to consume abnormal amounts of system resources due to an input validation error when matching filenames containing wildcard characters.

Although classifies this as a DoS vulnerability, several members of the security community believe it may be exploitable for arbitrary code execution.

Discovery 2004-09-30
Entry 2004-11-12
Modified 2008-09-26
gt 3.* lt 3.0.8

gt 3.*,1 lt 3.0.8,1

a63b15f9-97ff-11dc-9e48-0016179b2dd5samba -- multiple vulnerabilities

The Samba Team reports:

Secunia Research reported a vulnerability that allows for the execution of arbitrary code in nmbd. This defect may only be exploited when the "wins support" parameter has been enabled in smb.conf.

Samba developers have discovered what is believed to be a non-exploitable buffer over in nmbd during the processing of GETDC logon server requests. This code is only used when the Samba server is configured as a Primary or Backup Domain Controller.

Discovery 2007-11-15
Entry 2007-11-21
Modified 2008-09-26
lt 3.0.26a

gt *,1 lt 3.0.26a_2,1

2bc96f18-683f-11dc-82b6-02e0185f8d72samba -- nss_info plugin privilege escalation vulnerability

The Samba development team reports:

The library provides an nss_info extension to Winbind for retrieving a user's home directory path, login shell and primary group id from an Active Directory domain controller. This functionality is enabled by defining the "winbind nss info" smb.conf option to either "sfu" or "rfc2307".

Both the Windows "Identity Management for Unix" and "Services for Unix" MMC plug-ins allow a user to be assigned a primary group for Unix clients that differs from the user's Windows primary group. When the rfc2307 or sfu nss_info plugin has been enabled, in the absence of either the RFC2307 or SFU primary group attribute, Winbind will assign a primary group ID of 0 to the domain user queried using the getpwnam() C library call.

Discovery 2007-09-11
Entry 2007-09-21
Modified 2008-09-26
lt 3.0.26a

gt *,1 lt 3.0.26a,1

f3d3f621-38d8-11d9-8fff-000c6e8f12efsmbd -- buffer-overrun vulnerability

Caused by improper bounds checking of certain trans2 requests, there is a possible buffer overrun in smbd. The attacker needs to be able to create files with very specific Unicode filenames on the share to take advantage of this issue.

Discovery 2004-11-15
Entry 2004-11-17
Modified 2008-09-26
ge 3.* lt 3.0.8

ge 3.*,1 lt 3.0.8,1

57ae52f7-b9cc-11db-bf0f-0013720b182dsamba -- format string bug in VFS plugin

The Samba Team reports:

NOTE: This security advisory only impacts Samba servers that share AFS file systems to CIFS clients and which have been explicitly instructed in smb.conf to load the VFS module.

The source defect results in the name of a file stored on disk being used as the format string in a call to snprintf(). This bug becomes exploitable only when a user is able to write to a share which utilizes Samba's library for setting Windows NT access control lists on files residing on an AFS file system.

Discovery 2007-02-05
Entry 2007-03-16
ge 3.0.6,1 lt 3.0.24,1

ffcbd42d-a8c5-11dc-bec2-02e0185f8d72samba -- buffer overflow vulnerability

Secuna Research reports:

Secunia Research has discovered a vulnerability in Samba, which can be exploited by malicious people to compromise a vulnerable system. The vulnerability is caused due to a boundary error within the "send_mailslot()" function. This can be exploited to cause a stack-based buffer overflow with zero bytes via a specially crafted "SAMLOGON" domain logon packet containing a username string placed at an odd offset followed by an overly long GETDC string. Successful exploitation allows execution of arbitrary code, but requires that the "domain logons" option is enabled.

Discovery 2007-12-10
Entry 2007-12-12
Modified 2008-09-26
lt 3.0.28

gt *,1 lt 3.0.28,1