-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
==========================================================
This bug was originally reported against the anonymous calls
to the SamrChangePassword() MS-RPC function in combination
with the "username map script" smb.conf option (which is not
enabled by default).
After further investigation by Samba developers, it was
determined that the problem was much broader and impacts
remote printer and file share management as well. The root
cause is passing unfiltered user input provided via MS-RPC
calls to /bin/sh when invoking externals scripts defined
in smb.conf. However, unlike the "username map script"
vulnerability, the remote file and printer management scripts
require an authenticated user session.
A patch against Samba 3.0.24 has been posted at
http://www.samba.org/samba/security/
This defect may be alleviated by removing all defined
external script invocations (username map script, add
printer command, etc…) from smb.conf.
The Samba Team always encourages users to run the latest
stable release as a defense against attacks. If this
is not immediately possible, administrators should read
the "Server Security" documentation found at
http://www.samba.org/samba/docs/server_security.html
This vulnerability was discovered by an anonymous researcher
and reported to Samba developers by Joshua J. Drake, iDefense
Labs (http://www.idefense.com/), as part of their Vulnerability
Contributor Program.
The time line is as follows:
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iD8DBQFGR5YAIR7qMdg1EfYRAn91AKDpPgSVlYSbMEkxpIAWG9rD1Cl6kwCffrRO
VCdq+1LtZsACYv7Yt1sQKyE=
=wtvM
-----END PGP SIGNATURE-----