4.6 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:P/I:P/A:P
0.001 Low
EPSS
Percentile
47.0%
NOTE: This security advisory only affects Sun Solaris
systems running Samba’s winbindd daemon and configured to
make use of the nss_winbind.so.1 library for gethostbyname()
and getipnodebyname() name resolution queries. For example,
## /etc/nsswitch.conf
...
ipnodes: files winbind
hosts: files winbind
The buffer overrun is caused by copying a string passed
into the NSS interface into a static buffer prior to sending
the request to the winbindd daemon.
A patch against Samba 3.0.23d has been attached to this
email. This fix has be incorporated into the Samba 3.0.24
release. Patches are also available from at the Samba Security
page (http://www.samba.org/samba/security).
An unpatched Solaris server may be protected by removing
the ‘winbind’ entry from the hosts and ipnodes services in
/etc/nsswitch.conf.
This vulnerability was reported (including a proposed patch)
to Samba developers by Olivier Gay <[email protected]>. Much thanks
to Olivier for his cooperation and patience in the announcement
of this defect. The time line is as follows:
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team