CVE:CVE-2003-0201
CNNVD:CNNVD-200305-012
Samba是一套实现SMB(Server Messages Block)协议，跨平台进行文件共享和打印共享服务的程序。Samba-TNG是一款Samba的衍生版本。
Samba程序由于对外部输入缺少正确的边界缓冲区检查，远程攻击者可以利用这个漏洞以root用户权限在系统上执行任意指令。
问题是smbd/trans2.c文件中的call_trans2open()函数调用:
StrnCpy(fname，pname，namelen); /* Line 252 of smbd/trans2.c */
StrnCpy函数使用namelen拷贝pname到fname中，如果变量namelen赋值为strlen(pname)+1，就会发生缓冲区溢出。变量'fname'是_typedef_ pstring类型，是大小为1024字节的字符，如果pname超过1024字节，就可以覆盖堆栈中的敏感地址，精心构建提交数据可能以root用户权限在系统上执行任意指令。
solution:Upgrade samba samba to a higher version than 2.0.0,2.0.1,2.0.2,2.0.3,2.0.4,2.0.5,2.0.6,2.0.7,2.0.8,2.0.9,2.0.10,2.2.0,2.2.0a,2.2.1a,2.2.3a,2.2.4,2.2.5,2.2.6,2.2.7,2.2.7a,2.2.8,and avoid the version 2.0.0,2.0.1,2.0.2,2.0.3,2.0.4,2.0.5,2.0.6,2.0.7,2.0.8,2.0.9,2.0.10,2.2.0,2.2.0a,2.2.1a,2.2.3a,2.2.4,2.2.5,2.2.6,2.2.7,2.2.7a,2.2.8; Upgrade samba-tng samba-tng to a higher version than 0.3,0.3.1,and avoid the version 0.3,0.3.1; Upgrade apple mac_os_x to a higher version than 10.2,10.2.1,10.2.2,10.2.3,10.2.4,and avoid the version 10.2,10.2.1,10.2.2,10.2.3,10.2.4; Upgrade compaq tru64 to a higher version than 4.0b,4.0d,4.0d_pk9_bl17,4.0f,4.0f_pk6_bl17,4.0f_pk7_bl18,4.0g,4.0g_pk3_bl17,5.0,5.0_pk4_bl17,5.0_pk4_bl18,5.0a,5.0a_pk3_bl17,5.0f,5.1,5.1_pk3_bl17,5.1_pk4_bl18,5.1_pk5_bl19,5.1_pk6_bl20,5.1a,5.1a_pk1_bl1,5.1a_pk2_bl2,5.1a_pk3_bl3,5.1b,5.1b_pk1_bl1,and avoid the version 4.0b,4.0d,4.0d_pk9_bl17,4.0f,4.0f_pk6_bl17,4.0f_pk7_bl18,4.0g,4.0g_pk3_bl17,5.0,5.0_pk4_bl17,5.0_pk4_bl18,5.0a,5.0a_pk3_bl17,5.0f,5.1,5.1_pk3_bl17,5.1_pk4_bl18,5.1_pk5_bl19,5.1_pk6_bl20,5.1a,5.1a_pk1_bl1,5.1a_pk2_bl2,5.1a_pk3_bl3,5.1b,5.1b_pk1_bl1; Upgrade hp hp-ux to a higher version than 10.01,10.20,10.24,11.00,11.04,11.11,11.20,11.22,and avoid the version 10.01,10.20,10.24,11.00,11.04,11.11,11.20,11.22; Upgrade sun solaris to a higher version than 2.5.1,2.6,7.0,8.0,9.0,9.0:x86_update_2,and avoid the version 2.5.1,2.6,7.0,8.0,9.0,9.0:x86_update_2; Upgrade sun sunos to a higher version than -,5.5.1,5.7,5.8,and avoid the version 5.5.1,5.7,5.8; Upgrade hp cifs-9000_server to a higher version than a.01.05,a.01.06,a.01.07,a.01.08,a.01.08.01,a.01.09,a.01.09.01,a.01.09.02,and avoid the version a.01.05,a.01.06,a.01.07,a.01.08,a.01.08.01,a.01.09,a.01.09.01,a.01.09.02