Samba developers quash serious bug

Users of the open-source Samba software are being urged to patch their code following the discovery of a critical bug in the file-and-print software.

The bug is one of three vulnerabilities that were patched Monday by the Samba team in the Samba 3.0.25 release.

The flaw is considered to be particularly worrisome for two reasons: It could be remotely exploited by an attacker to run unauthorized code on the Samba server and there is no known work-around for the flaw. Samba ships with Linux and Unix operating systems and is a popular way of allowing Windows clients to print and store files using a Linux or Unix machine.

It's been a few years since Samba has had to fix this kind of vulnerability, which is due to a coding error affecting the way Samba puts data into the computer's memory, said Samba developer Jeremy Allison. "This kind of bug is rare for us," he said Monday in an e-mail interview. "That's why we're embarrassed."

Still, there is no known exploit code for the problem, and even if there were, an attacker would first have to find a way to reach a Samba server via Microsoft's Remote Procedure Call (RPC) service, which is typically blocked by the firewall.

The flaw could give attackers a way to jump from a compromised Windows computer to a Samba server, said David Endler, director of security research at 3Com's TippingPoint division, which first reported the flaw. "The real danger here is if an exploit is developed, it could be integrated into the latest botnet software," he said.

Endler added that he would be "surprised" if an exploit for the problem were not developed over the next few weeks.