As reported by Secunia Research, a buffer overflow vulnerability exists in the "reply_netbios_packet()" function in Samba, provided that the Samba server has been configured as a WINS Server. The vulnerability can be triggered by passing crafted WINS "Name Registration" requests followed by a WINS "Name Query" request.

Description:

Secunia Research have discovered a vulnerability with Samba that could lead to unprivileged accounts being able to run software of their choice on Samba servers that have been configured as a WINS Server.

Mitigation:

Update to Samba version 3.0.27 at the earliest opportunity.

Updates:

http://us1.samba.org/samba/security/CVE-2007-4572.html

Source:

http://secunia.com/secunia_research/2007-90/

Exploits:

CVE-ID: CVE-2007-5398 CVE-ID: 2007-4572