Pam_SMB Remote Buffer Overflow Vulnerability

Risk
High

Date Discovered
08-26-2003

Description
pam_smb has been reported prone to a buffer overflow vulnerability. It has been reported that systems using pam_smb to authenticate to a remotely accessible service may be vulnerable to a condition that may allow a remote attacker to supply and execute arbitrary code in the context of the vulnerable module.

Platforms Affected
Debian Linux 3.0
Debian Linux 3.0 alpha
Debian Linux 3.0 arm
Debian Linux 3.0 hppa
Debian Linux 3.0 ia-32
Debian Linux 3.0 ia-64
Debian Linux 3.0 m68k
Debian Linux 3.0 mips
Debian Linux 3.0 mipsel
Debian Linux 3.0 ppc
Debian Linux 3.0 s/390
Debian Linux 3.0 sparc
RedHat Enterprise Linux AS 2.1
RedHat Enterprise Linux AS 2.1 IA64
RedHat Enterprise Linux ES 2.1
RedHat Enterprise Linux WS 2.1
RedHat Enterprise Linux WS 2.1 IA64
RedHat Linux 7.2 i386
RedHat Linux 7.2 ia64
RedHat Linux 7.3 i386
RedHat Linux 8.0 i386
RedHat Linux 9.0 i386

Components Affected
pam_smb pam_smb 1.1
pam_smb pam_smb 1.1.1
pam_smb pam_smb 1.1.2
pam_smb pam_smb 1.1.3
pam_smb pam_smb 1.1.4
pam_smb pam_smb 1.1.5
pam_smb pam_smb 1.1.6
pam_smb pam_smb 2.0 -rc4
RedHat pam_smb-1.1.6-2.i386.rpm
RedHat pam_smb-1.1.6-2.i386.rpm
RedHat pam_smb-1.1.6-2.ia64.rpm
RedHat pam_smb-1.1.6-5.i386.rpm
RedHat pam_smb-1.1.6-7.i386.rpm

Recommendations
Block external access at the network boundary, unless service is required by external parties.
Restrict access to the affected server at the network perimeter. Allow communications from trusted hosts and networks only. Deny all other communications.

Implement multiple redundant layers of security.
An attacker's ability to exploit this vulnerability to execute arbitrary code may be hindered through the use of various memory protection schemes. Where possible, implement the use of non-executable and randomly mapped memory segments.

Red Hat has released a security advisory (RHSA-2003-262) to address this issue for enterprise customers. Further information regarding obtaining and applying fixes can be found in the referenced advisory.

Red Hat has released a security advisory (RHSA-2003:261-01) to address this issue. Customers who are affected by this issue are advised to apply the relevant fixes as soon as possible. Fixes are linked below. Further information regarding applying fixes can be found in the referenced advisory.

Debian has released an advisory (DSA 374-1) that addresses this issue. Please see the attached advisory for details on obtaining and applying fixes.

pam_smb have released a stable upgrade to address this issue:

pam_smb pam_smb 1.1:

pam_smb pam_smb 1.1.1:

pam_smb pam_smb 1.1.2:

pam_smb pam_smb 1.1.3:

pam_smb pam_smb 1.1.4:

pam_smb pam_smb 1.1.5:

pam_smb pam_smb 1.1.6:

pam_smb pam_smb 2.0 -rc4:
RedHat pam_smb-1.1.6-2.i386.rpm :

RedHat pam_smb-1.1.6-2.i386.rpm :

RedHat pam_smb-1.1.6-2.ia64.rpm :

RedHat pam_smb-1.1.6-5.i386.rpm :

RedHat pam_smb-1.1.6-7.i386.rpm :

References
Source: Debian DSA 374-1 libpam-smb
URL: http://online.securityfocus.com/advisories/5740

Source: RedHat RHSA-2003:261-01 Updated pam_smb packages fix remote buffer overflow.
URL: http://online.securityfocus.com/advisories/5735

Source: [Pam_smb] pam_smb Security Advisory - ALL versions as of 26-08-2003
URL: http://mailman.csn.ul.ie/pipermail/pam_smb/2003q3/000237.html

Source: pam_smb Homepage
URL: http://www.csn.ul.ie/~airlied/pam_smb/

Source: RHSA-2003-262 - Updated pam_smb packages fix remote buffer overflow.
URL: http://rhn.redhat.com/errata/RHSA-2003-262.html

Credits
Discovery of this vulnerability has been credited to Craig Miskell.

Copyright (c) 2003 by Symantec Corp.
Permission to redistribute this alert electronically is granted as long as it is not edited in any way unless authorized by Symantec Security Response. Reprinting the whole or part of this alert in any medium other than electronically requires permission from symsecurity@symantec.com.

Disclaimer
The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.

Symantec, Symantec products, Symantec Security Response, and SymSecurity are registered trademarks of Symantec Corp. and/or affiliated companies in the United States and other countries. All other registered and unregistered trademarks represented in this document are the sole property of their respective companies/owners.