GLSA 200409-14: Samba: Remote printing non-vulnerability

http://security.gentoo.org/

Severity:	low
Title:	Samba: Remote printing non-vulnerability
Date:	09/09/2004
Bugs:	#62476
ID:	200409-14

Synopsis

Samba has a bug with out of sequence print change notification requests, but it cannot be used to perform a remote denial of service attack.

Background

Samba is a freely available SMB/CIFS implementation which allows seamless interoperability of file and print services to other SMB/CIFS clients.

Affected packages

Package	Vulnerable	Unaffected	Architecture(s)

Description

Due to a bug in the printer_notify_info() function, authorized users could potentially crash their smbd process by sending improperly handled print change notification requests in an invalid order. Windows XP SP2 clients can trigger this behavior by sending a FindNextPrintChangeNotify() request before previously sending a FindFirstPrintChangeNotify() request.

Impact

We incorrectly thought that this bug could be exploited to deny service to all Samba users. It is not the case, this bug has no security impact whatsoever. Many thanks to Jerry Carter from the Samba team for correcting our mistake.

Workaround

There is no need for a workaround.

Resolution

Samba users can keep their current versions.

References

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200409-14.xml

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.