Samba RPC Network Data Representation Marshalling Vulnerability

Secunia ID	SA48742
CVE-ID	CVE-2012-1182
Release Date	11 Apr 2012
Last Change	02 Jul 2012
Criticality	Moderately Critical
Solution Status	Vendor Patch
Software	Samba 3.x
Where	From local network
Impact	System access This covers vulnerabilities where malicious people are able to gain system access and execute arbitrary code with the privileges of a local user.
Description	A vulnerability has been reported in Samba, which can be exploited by malicious people to compromise a vulnerable system. The vulnerability is caused due to an error within the Network Data Representation (NDR) marshalling functionality when handling PULL EVENTLOG ReportEventAndSourceW requests and can be exploited to cause a heap-based buffer overflow via a specially crafted remote procedure call. Successful exploitation may allow execution of arbitrary code. The vulnerability is reported in versions 3.0.x through 3.6.3.
Solution	Apply patch or update to version 3.6.4, 3.5.14, or 3.4.16. http://www.samba.org/samba/patches/
Reported by	Brian Gorenc, HP DVLabs and an anonymous person via ZDI.
Original Advisory	Samba: http://www.samba.org/samba/security/CVE-2012-1182 DVLabs: http://dvlabs.tippingpoint.com/advisory/TPTI-12-04 ZDI: http://www.zerodayinitiative.com/advisories/ZDI-12-061/ http://www.zerodayinitiative.com/advisories/ZDI-12-062/ http://www.zerodayinitiative.com/advisories/ZDI-12-063/ http://www.zerodayinitiative.com/advisories/ZDI-12-064/ http://www.zerodayinitiative.com/advisories/ZDI-12-068/ http://www.zerodayinitiative.com/advisories/ZDI-12-069/ http://www.zerodayinitiative.com/advisories/ZDI-12-070/ http://www.zerodayinitiative.com/advisories/ZDI-12-071/ http://www.zerodayinitiative.com/advisories/ZDI-12-072/

© 1997-2013 Kaspersky Lab ZAO. All Rights Reserved.
Industry-leading Antivirus Software.
Registered trademarks and service marks are the property of their respective owners.
The authors' opinions do not necessarily reflect the official positions of Kaspersky Lab.