Researcher Finds Linux, Samba Security BugsResearcher Finds Linux, Samba Security Bugs

A security expert this week reported two potentially significant bugs in Linux software used to share file and print services with Windows-based systems.

According to Stefan Esser, chief security officer at e-matters GmbH, a German security consulting firm, the first vulnerability affects Samba, an open-source product that provides file and print services to SMB/CIFS clients, including those using Windows. Esser said an attacker could use a buffer overflow exploit to execute arbitrary code on an unpatched Samba server.

An e-matters security advisory published Monday rates the bug, which affects Samba versions 3.0 through 3.0.7, as "critical." According to the advisory, the current Samba 3.0.8 update is not vulnerable.

A second bug, announced by e-matters Wednesday, affects smbfs, the Server Message Block (SMB) file system for Linux. The smbfs module, part of the Linux kernel, enables communication with Windows computers on a local network.

According to Esser, an attacker could use the smbfs flaw to launch denial-of-service attacks by crashing the Linux kernel or leaking kernel memory. In order to exploit the flaw, however, the attacker must also control the answers from a connected SMB server, most likely through the use of "man in the middle" attacks or the previously reported buffer overflow attack.

Esser left open the possibility that the flaw may allow other types of attacks. "While any of these vulnerabilities can be easily used as remote denial-of-service exploits against Linux systems, it is unclear if it is possible for a skilled local or remote attacker to use any of the possible buffer overflows for arbitrary code execution in kernel space," he said in an e-matters advisory.

The flaw, rated "moderately critical," is fixed in the Linux version 2.4.28 kernel. At press time, according to the e-matters advisory, a fix for the version 2.6 kernel was not yet available.

Samba version 3.0.8 is available as a free download from the Samba Web site. Available Linux kernel updates vary by individual Linux distribution vendor, but current production kernels are also available at the LinuxHP Web site as free downloads.