diff options
| author | Gerald (Jerry) Carter <jerry@samba.org> | 2007-11-14 20:51:14 -0600 |
|---|---|---|
| committer | Gerald (Jerry) Carter <jerry@samba.org> | 2007-11-15 10:57:31 -0600 |
| commit | e40c372e0ddf631dd9162c1fdfaaa49c29915f23 (patch) | |
| tree | afe0d27099db5d662f68dcb2d657b331f44d3486 /source/nmbd | |
| parent | 242fc0099cc81877d8e9630b46dfb8d4a3265d94 (diff) | |
| download | samba-e40c372e0ddf631dd9162c1fdfaaa49c29915f23.tar.gz | |
Fix for CVE-2007-5398.
== Subject: Remote code execution in Samba's WINS
== server daemon (nmbd) when processing name
== registration followed name query requests.
==
== CVE ID#: CVE-2007-5398
==
== Versions: Samba 3.0.0 - 3.0.26a (inclusive)
...
Secunia Research reported a vulnerability that allows for
the execution of arbitrary code in nmbd. This defect may
only be exploited when the "wins support" parameter has
been enabled in smb.conf.
Diffstat (limited to 'source/nmbd')
| -rw-r--r-- | source/nmbd/nmbd_packets.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/source/nmbd/nmbd_packets.c b/source/nmbd/nmbd_packets.c index d49c8bab799..b78ab5ba7eb 100644 --- a/source/nmbd/nmbd_packets.c +++ b/source/nmbd/nmbd_packets.c @@ -970,6 +970,12 @@ for id %hu\n", packet_type, nmb_namestr(&orig_nmb->question.question_name), nmb->answers->ttl = ttl; if (data && len) { + if (len < 0 || len > sizeof(nmb->answers->rdata)) { + DEBUG(5,("reply_netbios_packet: " + "invalid packet len (%d)\n", + len )); + return; + } nmb->answers->rdlength = len; memcpy(nmb->answers->rdata, data, len); } |