Description
The smb_recv_trans2 function call in the samba filesystem (smbfs) in Linux kernel 2.4 and 2.6 does not properly handle the re-assembly of fragmented packets correctly, which could allow remote samba servers to (1) read arbitrary kernel information or (2) raise a counter value to an arbitrary number by sending the first part of the fragmented packet multiple times.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://secunia.com/advisories/20163 ↗
- http://www.securityfocus.com/bid/11695 ↗
- http://www.debian.org/security/2006/dsa-1082 ↗
- http://www.mandriva.com/security/advisories?name=MDKSA-2005:022 ↗
- http://marc.info/?l=bugtraq&m=110072140811965&w=2 ↗
- https://bugzilla.fedora.us/show_bug.cgi?id=2336 ↗
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10360 ↗
- https://www.ubuntu.com/usn/usn-30-1/ ↗
- http://security.e-matters.de/advisories/142004.html ↗
- http://www.debian.org/security/2006/dsa-1070 ↗
- http://www.redhat.com/support/errata/RHSA-2004-537.html ↗
- http://secunia.com/advisories/20162 ↗
- https://exchange.xforce.ibmcloud.com/vulnerabilities/18137 ↗
- http://www.debian.org/security/2006/dsa-1067 ↗
- http://www.debian.org/security/2006/dsa-1069 ↗
- http://www.trustix.org/errata/2004/0061/ ↗
- http://www.redhat.com/support/errata/RHSA-2004-505.html ↗
- http://secunia.com/advisories/20202 ↗
- http://www.redhat.com/support/errata/RHSA-2004-504.html ↗
- http://secunia.com/advisories/13232/ ↗
- http://secunia.com/advisories/20338 ↗