Advisory Details

April 18th, 2012

Samba NDR PULL SVCCTL StartServiceW Heap Overflow Remote Code Execution Vulnerability

CVE ID	CVE-2012-1182
CVSS SCORE	10.0, AV:N/AC:L/Au:N/C:C/I:C/A:C
AFFECTED VENDORS	Samba
AFFECTED PRODUCTS	3.6.x
TREND MICRO CUSTOMER PROTECTION	Trend Micro TippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID ['12224']. For further product information on the TippingPoint IPS: http://www.tippingpoint.com
VULNERABILITY DETAILS	This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samba. Authentication is not required to exploit this vulnerability. The specific flaw exists within Samba's handling of a NDR PULL SVCCTL StartServiceW request. By sending a specially crafted packet, it is possible to cause Samba to use a different size for memory allocation than it uses for a memory copy loop. This can result in memory corruption, and may be exploited by an attacker to gain remote code execution.
ADDITIONAL DETAILS	Samba has issued an update to correct this vulnerability. More details can be found at: http://www.samba.org/samba/security/CVE-2012-1182
DISCLOSURE TIMELINE	2011-10-20 - Vulnerability reported to vendor 2012-04-18 - Coordinated public release of advisory
CREDIT	Anonymous

BACK TO ADVISORIES