Samba nmbd NetBIOS Name Service Remote Code Execution Vulnerability (CVE-2014-3560)

Samba nmbd NetBIOS Name Service Remote Code Execution Vulnerability (CVE-2014-3560)

Release date:
Updated on:

Affected Systems:
Samba 4.0.0-4.1.10
Description:
--------------------------------------------------------------------------------
CVE (CAN) ID: CVE-2014-3560
 
Samba is a set of programs that implement the SMB (Server Messages Block) protocol, cross-platform file sharing and print sharing services.
 
Samba 4.0.0-4.1.10 has a remote code execution vulnerability in nmbd NetBIOS Name Service implementation. Malicious browsers can send packets to overwrite the heap of the Target name service program, then execute any code with the superuser permission.

------------------------------------ Split line ------------------------------------

How to share files with Samba in Ubuntu 14.04

The speed of accessing samba from Ubuntu dual Nic of VMWare Virtual Machine doubles

Add the Samba File Sharing Server to the Windows Server 2003 Domain

Samba installation Configuration

Samba service configuration in CentOS 6.2

How to Build the Win7 + VMware + Fedora18 Samba Server

------------------------------------ Split line ------------------------------------
 
<* Source: Volker Lendecke

Link: http://www.samba.org/samba/security/CVE-2014-3560
*>

Suggestion:
--------------------------------------------------------------------------------
Temporary solution:
 
If you cannot install or upgrade the patch immediately, NSFOCUS recommends that you take the following measures to reduce the threat:
 
* Do not run the nmbd or NetBIOS name service program.
 
Vendor patch:
 
Samba
-----
Samba has released a Security Bulletin (CVE-2014-3560) and patches for this:
CVE-2014-3560: Remote code execution in nmbd.
Link: http://www.samba.org/samba/security/CVE-2014-3560
 
Patch download: http://samba.org/samba/patches/

Samba details: click here
Samba: click here

This article permanently updates the link address: