Samba是一套实现SMB（Server Messages Block）协议、跨平台进行文件共享和打印共享服务的程序。

Samba的NDR函数实现上存在漏洞，远程攻击者可能利用此漏洞控制Samba服务器。

Samba没有正确地验证发送给多个RPC接口的RPC请求，在解析对LsarAddPrivilegesToAccount、DFSEnum、RFNPCNEX、NetSetFileSecurity和LsarLookupSids/LsarLookupSids2的请求时，堆分配是基于用户输入计算的，因此攻击者可以通过指定无效的值覆盖堆块，导致执行任意代码。

<*来源：Brian Schafer

链接：http://marc.info/?l=bugtraq&m=117916538304566&w=2
http://www.kb.cert.org/vuls/id/773720
http://marc.info/?l=bugtraq&m=117926211513644&w=2
http://marc.info/?l=bugtraq&m=117926250719549&w=2
http://marc.info/?l=bugtraq&m=117926191206711&w=2
http://marc.info/?l=bugtraq&m=117926277431827&w=2
http://marc.info/?l=bugtraq&m=117926726621503&w=2
http://lwn.net/Alerts/234272/?format=printable
http://www.debian.org/security/2007/dsa-1291
http://security.gentoo.org/glsa/glsa-200705-15.xml
*>

建议：
--------------------------------------------------------------------------------
厂商补丁：

Debian
------
Debian已经为此发布了一个安全公告（DSA-1291-1）以及相应补丁:
DSA-1291-1：New samba packages fix multiple vulnerabilities
链接：http://www.debian.org/security/2007/dsa-1291

补丁下载：

Source archives:

http://security.debian.org/pool/updates/main/s/samba/samba_3.0.24-6etch1.dsc
Size/MD5 checksum: 1425 04c3ba2544a4dba0e23748697bbcb93c
http://security.debian.org/pool/updates/main/s/samba/samba_3.0.24.orig.tar.gz
Size/MD5 checksum: 17708128 89273f67a6d8067cbbecefaa13747153
http://security.debian.org/pool/updates/main/s/samba/samba_3.0.24-6etch1.diff.gz
Size/MD5 checksum: 209279 01a1d7d0cb1afcb8cff7da5937c72318

Architecture independent packages:

http://security.debian.org/pool/updates/main/s/samba/samba-doc_3.0.24-6etch1_all.deb
Size/MD5 checksum: 6913100 ad2bda3c198d48346696f83dcc44a919
http://security.debian.org/pool/updates/main/s/samba/samba-doc-pdf_3.0.24-6etch1_all.deb
Size/MD5 checksum: 6598732 ae5dd6f0ee9ede4135507778fe939c5b

alpha architecture (DEC Alpha)

http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.0.24-6etch1_alpha.deb
Size/MD5 checksum: 12298820 361c9a38d1601d5f40b5999712b421ce
http://security.debian.org/pool/updates/main/s/samba/smbclient_3.0.24-6etch1_alpha.deb
Size/MD5 checksum: 4845328 6cadfc3b139943f558066c08737d43f6
http://security.debian.org/pool/updates/main/s/samba/winbind_3.0.24-6etch1_alpha.deb
Size/MD5 checksum: 2286174 f020a21acc276108270b364574635bff
http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.0.24-6etch1_alpha.deb
Size/MD5 checksum: 879246 cd710df2be2d347a3a57d4aeb3e538e0
http://security.debian.org/pool/updates/main/s/samba/python-samba_3.0.24-6etch1_alpha.deb
Size/MD5 checksum: 6705430 2b66a4a7d2e202592af3e76143246085
http://security.debian.org/pool/updates/main/s/samba/swat_3.0.24-6etch1_alpha.deb
Size/MD5 checksum: 956068 c78ed74384834b23fc0cdb744eae6ca4
http://security.debian.org/pool/updates/main/s/samba/smbfs_3.0.24-6etch1_alpha.deb
Size/MD5 checksum: 521138 be541e59b60bbaf52cb410ae77afe8a9
http://security.debian.org/pool/updates/main/s/samba/samba_3.0.24-6etch1_alpha.deb
Size/MD5 checksum: 4000850 42c314e7c7baa6713e34fff690b94b63
http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.0.24-6etch1_alpha.deb
Size/MD5 checksum: 482750 962077ae64d617de90980ca7536844e2
http://security.debian.org/pool/updates/main/s/samba/samba-common_3.0.24-6etch1_alpha.deb
Size/MD5 checksum: 2841098 0b9e462523e6e5deb926833b64738751
http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.0.24-6etch1_alpha.deb
Size/MD5 checksum: 113804 2596db0188695f092541f23d5e702842

amd64 architecture (AMD x86_64 (AMD64))

http://security.debian.org/pool/updates/main/s/samba/samba-common_3.0.24-6etch1_amd64.deb
Size/MD5 checksum: 2596718 117b0b1a3193555a92616ee3ff0da86e
http://security.debian.org/pool/updates/main/s/samba/smbclient_3.0.24-6etch1_amd64.deb
Size/MD5 checksum: 4313262 db755a802d383326238d0a097ed1a414
http://security.debian.org/pool/updates/main/s/samba/swat_3.0.24-6etch1_amd64.deb
Size/MD5 checksum: 866346 074ca20601c8b3cbc51d789111dab2d9
http://security.debian.org/pool/updates/main/s/samba/samba_3.0.24-6etch1_amd64.deb
Size/MD5 checksum: 3601326 0f3a2fdcb3f6eb6fc389b3e59e8f5322
http://security.debian.org/pool/updates/main/s/samba/winbind_3.0.24-6etch1_amd64.deb
Size/MD5 checksum: 2074422 c9ad0ee8260f636c9c90b8d9d2afe478
http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.0.24-6etch1_amd64.deb
Size/MD5 checksum: 12190696 4c185a1d0ecab5f38d2d3d64593ae250
http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.0.24-6etch1_amd64.deb
Size/MD5 checksum: 831218 68db9d99816eb815890cdfe086632fbb
http://security.debian.org/pool/updates/main/s/samba/smbfs_3.0.24-6etch1_amd64.deb
Size/MD5 checksum: 456592 e1e40461c0318acf4c439e9d83d9f7ae
http://security.debian.org/pool/updates/main/s/samba/python-samba_3.0.24-6etch1_amd64.deb
Size/MD5 checksum: 6254606 267d6c998a186f4416de23cede305739
http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.0.24-6etch1_amd64.deb
Size/MD5 checksum: 461594 c5cd65237a6361d3790e6277c84f4830
http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.0.24-6etch1_amd64.deb
Size/MD5 checksum: 112092 c22e8aaa62deb3e1ceb5972acd9090e5

hppa architecture (HP PA RISC)

http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.0.24-6etch1_hppa.deb
Size/MD5 checksum: 112084 32e2be10c3bf29746505221056ae358a
http://security.debian.org/pool/updates/main/s/samba/smbclient_3.0.24-6etch1_hppa.deb
Size/MD5 checksum: 4428150 4e53b7ec668d6156452469ecc0a51051
http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.0.24-6etch1_hppa.deb
Size/MD5 checksum: 484206 ccabe214660f062d6070db209a259e4d
http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.0.24-6etch1_hppa.deb
Size/MD5 checksum: 877280 4b2ae61f6c51854b06249ebf0c746fd6
http://security.debian.org/pool/updates/main/s/samba/smbfs_3.0.24-6etch1_hppa.deb
Size/MD5 checksum: 470476 6f76bdef8b9f4894fa44fd426c00a90a
http://security.debian.org/pool/updates/main/s/samba/python-samba_3.0.24-6etch1_hppa.deb
Size/MD5 checksum: 6562278 1b84e2389afc3c8105df0e53af6f0166
http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.0.24-6etch1_hppa.deb
Size/MD5 checksum: 11912634 e01b0888203c9fb07cee7d1c93528132
http://security.debian.org/pool/updates/main/s/samba/winbind_3.0.24-6etch1_hppa.deb
Size/MD5 checksum: 2135120 cc819588fa69b8a84ccbfb9678e5a72b
http://security.debian.org/pool/updates/main/s/samba/swat_3.0.24-6etch1_hppa.deb
Size/MD5 checksum: 885710 3dc27bc180a74e7f8236ca4542f4dc2c
http://security.debian.org/pool/updates/main/s/samba/samba-common_3.0.24-6etch1_hppa.deb
Size/MD5 checksum: 2647730 28540ba66a7863ccaa663bd07c9c5a78
http://security.debian.org/pool/updates/main/s/samba/samba_3.0.24-6etch1_hppa.deb
Size/MD5 checksum: 3697062 9c6830b8952dd726d4464b55d897b441

i386 architecture (Intel ia32)

http://security.debian.org/pool/updates/main/s/samba/samba-common_3.0.24-6etch1_i386.deb
Size/MD5 checksum: 2381152 be2a088823984244c12f433367cb7e43
http://security.debian.org/pool/updates/main/s/samba/samba_3.0.24-6etch1_i386.deb
Size/MD5 checksum: 3260934 dd89988baf2a2a5666c04308741c192e
http://security.debian.org/pool/updates/main/s/samba/winbind_3.0.24-6etch1_i386.deb
Size/MD5 checksum: 1865236 7cca547c796723de84fad06c8513462e
http://security.debian.org/pool/updates/main/s/samba/python-samba_3.0.24-6etch1_i386.deb
Size/MD5 checksum: 5662336 22d72d620f89b1709d1f02db5a8bbbe1
http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.0.24-6etch1_i386.deb
Size/MD5 checksum: 11882486 6e3b3e334c9667758d16e839d3f66bef
http://security.debian.org/pool/updates/main/s/samba/smbfs_3.0.24-6etch1_i386.deb
Size/MD5 checksum: 412516 f3265d34230872fe63822ccad8e134a2
http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.0.24-6etch1_i386.deb
Size/MD5 checksum: 418526 8473b5b9a03b0d33e01b20a451b45899
http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.0.24-6etch1_i386.deb
Size/MD5 checksum: 757726 4a7e0d3fb6be42c1d5b3a6bd416dfe90
http://security.debian.org/pool/updates/main/s/samba/swat_3.0.24-6etch1_i386.deb
Size/MD5 checksum: 793296 512fec08054b45f82372161e4291e911
http://security.debian.org/pool/updates/main/s/samba/smbclient_3.0.24-6etch1_i386.deb
Size/MD5 checksum: 3880846 27c628acf8f8f614444ec30895c78f78
http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.0.24-6etch1_i386.deb
Size/MD5 checksum: 112084 c6d09df4ac3bf72d3f12de2b88ebb3d5

ia64 architecture (Intel ia64)

http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.0.24-6etch1_ia64.deb
Size/MD5 checksum: 11172948 97c6711185c37211439777a41d3c2cb3
http://security.debian.org/pool/updates/main/s/samba/smbfs_3.0.24-6etch1_ia64.deb
Size/MD5 checksum: 626988 dc3ba71d8b8a22e00bedfea2e45fa57b
http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.0.24-6etch1_ia64.deb
Size/MD5 checksum: 1068180 5289361cdddfe0f434305b155dfae717
http://security.debian.org/pool/updates/main/s/samba/smbclient_3.0.24-6etch1_ia64.deb
Size/MD5 checksum: 6079128 cd85e3ecb5730d548b540b0f3e9bef63
http://security.debian.org/pool/updates/main/s/samba/winbind_3.0.24-6etch1_ia64.deb
Size/MD5 checksum: 2883022 13d0ca301a6111fbf95fc66fd0273e95
http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.0.24-6etch1_ia64.deb
Size/MD5 checksum: 591756 c885ab514c125efd673250405fa5c694
http://security.debian.org/pool/updates/main/s/samba/python-samba_3.0.24-6etch1_ia64.deb
Size/MD5 checksum: 8087972 0edf67416c8436e90fe6f24d0a903d5c
http://security.debian.org/pool/updates/main/s/samba/samba-common_3.0.24-6etch1_ia64.deb
Size/MD5 checksum: 3476098 26b315a42c939a36b0a4217a69d6cd73
http://security.debian.org/pool/updates/main/s/samba/swat_3.0.24-6etch1_ia64.deb
Size/MD5 checksum: 1181398 6126d78eb2d1220401af9e23bdf5d312
http://security.debian.org/pool/updates/main/s/samba/samba_3.0.24-6etch1_ia64.deb
Size/MD5 checksum: 5041370 30447d1104aa64c4b153a940ff3bb789
http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.0.24-6etch1_ia64.deb
Size/MD5 checksum: 112088 fc008875e6d262be644a45a17a72c9c7

mips architecture (MIPS (Big Endian))

http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.0.24-6etch1_mips.deb
Size/MD5 checksum: 432746 7ea8cd6997ab3149a02ea2622da87fd1
http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.0.24-6etch1_mips.deb
Size/MD5 checksum: 753652 abe34cc4cb29ce9388d23acbbb255ff0
http://security.debian.org/pool/updates/main/s/samba/winbind_3.0.24-6etch1_mips.deb
Size/MD5 checksum: 2000526 6ae2083bd3aa9a7267da25997ace40a3
http://security.debian.org/pool/updates/main/s/samba/python-samba_3.0.24-6etch1_mips.deb
Size/MD5 checksum: 5492530 cdddd72b4205f49040dbb2967f29ba5d
http://security.debian.org/pool/updates/main/s/samba/smbclient_3.0.24-6etch1_mips.deb
Size/MD5 checksum: 4175528 3903a543e95c6e7c70c62e4cc3849ad7
http://security.debian.org/pool/updates/main/s/samba/samba_3.0.24-6etch1_mips.deb
Size/MD5 checksum: 3542680 09c463b2638c5163fc79681f7f180339
http://security.debian.org/pool/updates/main/s/samba/smbfs_3.0.24-6etch1_mips.deb
Size/MD5 checksum: 454024 fdf2853ff63622b75ec7e103068dcf91
http://security.debian.org/pool/updates/main/s/samba/swat_3.0.24-6etch1_mips.deb
Size/MD5 checksum: 832888 bb5db880a1016dc47f3077e5ec90718f
http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.0.24-6etch1_mips.deb
Size/MD5 checksum: 112090 d2b104f9800c1cc72951b44ab99a0d4c
http://security.debian.org/pool/updates/main/s/samba/samba-common_3.0.24-6etch1_mips.deb
Size/MD5 checksum: 2528098 1cd05b859916b7075c0b76fcebf95e4e
http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.0.24-6etch1_mips.deb
Size/MD5 checksum: 12721292 22efcdaedf6112d9e07867ca78ff47b6

mipsel architecture (MIPS (Little Endian))

http://security.debian.org/pool/updates/main/s/samba/samba-common_3.0.24-6etch1_mipsel.deb
Size/MD5 checksum: 2527908 91c8e019ae5b2120149ab7c920563754
http://security.debian.org/pool/updates/main/s/samba/samba_3.0.24-6etch1_mipsel.deb
Size/MD5 checksum: 3548740 4d5aabe33e53b1ec3d7c0397e9f7f33d
http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.0.24-6etch1_mipsel.deb
Size/MD5 checksum: 112094 1d36f7e76865fbc6ed6890740d0e7ea0
http://security.debian.org/pool/updates/main/s/samba/swat_3.0.24-6etch1_mipsel.deb
Size/MD5 checksum: 833962 d293a4f8fdd7ed57390ad110644fce31
http://security.debian.org/pool/updates/main/s/samba/smbfs_3.0.24-6etch1_mipsel.deb
Size/MD5 checksum: 454188 e066713bf985c0d21b3884704ef716eb
http://security.debian.org/pool/updates/main/s/samba/winbind_3.0.24-6etch1_mipsel.deb
Size/MD5 checksum: 2002348 58fa19e94640f71a0111b91336ce99bc
http://security.debian.org/pool/updates/main/s/samba/smbclient_3.0.24-6etch1_mipsel.deb
Size/MD5 checksum: 4173020 88bc50ea0528e76f53483d9ca41cac6b
http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.0.24-6etch1_mipsel.deb
Size/MD5 checksum: 754156 7388e5790cd225adb341b18943cee145
http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.0.24-6etch1_mipsel.deb
Size/MD5 checksum: 12367098 f7db764415f16e66718ed178c5f85237
http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.0.24-6etch1_mipsel.deb
Size/MD5 checksum: 432248 cde18ceec94836f518ae8c890bc10162
http://security.debian.org/pool/updates/main/s/samba/python-samba_3.0.24-6etch1_mipsel.deb
Size/MD5 checksum: 5485004 eee18419bf330a8088e7bc324f64ea43

powerpc architecture (PowerPC)

http://security.debian.org/pool/updates/main/s/samba/swat_3.0.24-6etch1_powerpc.deb
Size/MD5 checksum: 850436 0416faeed5767b2e0edb52ecf0a78241
http://security.debian.org/pool/updates/main/s/samba/winbind_3.0.24-6etch1_powerpc.deb
Size/MD5 checksum: 2028084 c7376b05df22ee4aa79126cc9a5195ac
http://security.debian.org/pool/updates/main/s/samba/smbfs_3.0.24-6etch1_powerpc.deb
Size/MD5 checksum: 456368 731295892c48c8f145ff75428c9154ae
http://security.debian.org/pool/updates/main/s/samba/samba-common_3.0.24-6etch1_powerpc.deb
Size/MD5 checksum: 2547460 932f5ca8fe45c64528396fa9f2a9beae
http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.0.24-6etch1_powerpc.deb
Size/MD5 checksum: 112094 e46062fd60fd4a9eb3f622fdf5f144f1
http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.0.24-6etch1_powerpc.deb
Size/MD5 checksum: 12443346 4e6acbf1ca2fd3e5f8d91985993b3e2a
http://security.debian.org/pool/updates/main/s/samba/python-samba_3.0.24-6etch1_powerpc.deb
Size/MD5 checksum: 6016288 e53dd47de7747ea05de274e30af5e943
http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.0.24-6etch1_powerpc.deb
Size/MD5 checksum: 449712 7e1abed25a0c2f6475709bc7c0e87311
http://security.debian.org/pool/updates/main/s/samba/smbclient_3.0.24-6etch1_powerpc.deb
Size/MD5 checksum: 4229306 0f8a9c2f8023fa2f0c6f3e964cea6327
http://security.debian.org/pool/updates/main/s/samba/samba_3.0.24-6etch1_powerpc.deb
Size/MD5 checksum: 3552136 85d3928828989f62e827e1195b727c9e
http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.0.24-6etch1_powerpc.deb
Size/MD5 checksum: 815718 034c2318ad76f4a7dda5b64c7d0db39b

s390 architecture (IBM S/390)

http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.0.24-6etch1_s390.deb
Size/MD5 checksum: 112082 15258a469aa6d1727fb51f6f1003857b
http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.0.24-6etch1_s390.deb
Size/MD5 checksum: 838852 518d3c64251d00414be3c4c961107ea5
http://security.debian.org/pool/updates/main/s/samba/swat_3.0.24-6etch1_s390.deb
Size/MD5 checksum: 843824 adbd5b2cdb20acde573aa41697e43495
http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.0.24-6etch1_s390.deb
Size/MD5 checksum: 12288702 434850ca8340de23c1581e6f0ecb258f
http://security.debian.org/pool/updates/main/s/samba/winbind_3.0.24-6etch1_s390.deb
Size/MD5 checksum: 2062906 fa37293fb98fcaf49da701be6bf7be60
http://security.debian.org/pool/updates/main/s/samba/python-samba_3.0.24-6etch1_s390.deb
Size/MD5 checksum: 6376522 dccbddd886e99d0d43672f612f2709b3
http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.0.24-6etch1_s390.deb
Size/MD5 checksum: 476980 bdf50a77207714ff5e7a05109180bc3e
http://security.debian.org/pool/updates/main/s/samba/smbfs_3.0.24-6etch1_s390.deb
Size/MD5 checksum: 458840 cd8b0e10214411f78b812ae81e65abd4
http://security.debian.org/pool/updates/main/s/samba/samba-common_3.0.24-6etch1_s390.deb
Size/MD5 checksum: 2557334 65ac639e305ce9ca04bb1842e55c6c3c
http://security.debian.org/pool/updates/main/s/samba/samba_3.0.24-6etch1_s390.deb
Size/MD5 checksum: 3563638 56cda1a9fb87dd7647f27951a0098047
http://security.debian.org/pool/updates/main/s/samba/smbclient_3.0.24-6etch1_s390.deb
Size/MD5 checksum: 4234808 53ea004c15be309f0962a2e7d97b7408

补丁安装方法：

1. 手工安装补丁包：

首先，使用下面的命令来下载补丁软件：
# wget url (url是补丁下载链接地址)

然后，使用下面的命令来安装补丁：
# dpkg -i file.deb (file是相应的补丁名)

2. 使用apt-get自动安装补丁包：

首先，使用下面的命令更新内部数据库：
# apt-get update

然后，使用下面的命令安装更新软件包：
# apt-get upgrade

RedHat
------
RedHat已经为此发布了一个安全公告（RHSA-2007:0354-01）以及相应补丁:
RHSA-2007:0354-01：Critical: samba security update
链接：http://lwn.net/Alerts/234272/?format=printable

Samba
-----
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：

http://www.samba.org/samba/ftp/patches/security/samba-3.0.24-CVE-2007-2446.patch

Gentoo
------
Gentoo已经为此发布了一个安全公告（GLSA-200705-15）以及相应补丁:
GLSA-200705-15：Samba: Multiple vulnerabilities
链接：http://security.gentoo.org/glsa/glsa-200705-15.xml

所有Samba用户都应升级到最新版本：

# emerge --sync
# emerge --ask --oneshot --verbose ">=net-fs/samba-3.0.24-r2"