-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

==========================================================

== Subject: Remote code execution in Samba's WINS
== server daemon (nmbd) when processing name
== registration followed name query requests.

== CVE ID#: CVE-2007-5398

== Versions: Samba 3.0.0 - 3.0.26a (inclusive)

== Summary: When nmbd has been configured as a WINS
== server, a client can send a series of name
== registration request followed by a specific
== name query request packet and execute
== arbitrary code.

==========================================================

===========
Description

Secunia Research reported a vulnerability that allows for
the execution of arbitrary code in nmbd. This defect may
only be exploited when the "wins support" parameter has
been enabled in smb.conf.

==================
Patch Availability

A patch addressing this defect has been posted to

http://www.samba.org/samba/security/

Additionally, Samba 3.0.27 has been issued as a security
release to correct the defect.

==========
Workaround

Samba administrators may avoid this security issue by
disabling the "wins support" feature in the hosts smb.conf
file.

=======
Credits

This vulnerability was reported to Samba developers by
Alin Rad Pop, Secunia Research.

The time line is as follows:

• Oct 30, 2007: Initial report to [email protected].
• Oct 30, 2007: First response from Samba developers confirming
  the bug along with a proposed patch.
• Nov 15, 2007: Public security advisory to be made available.

==========================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFHPEe6IR7qMdg1EfYRAqoAAJsHFk1kScYHweqRny4PP4ngQaFo7QCdElle
Cv+e7K/AE69rXcmeU67jHzQ=
=9Wap
-----END PGP SIGNATURE-----