Check Point Advisories

Samba SWAT HTTP Authentication Buffer Overflow (CVE-2004-0600)

Vulnerability
Protection

Check Point Reference:	CPAI-2004-160
Date Published:	27 Oct 2009
Severity:	Critical
Last Updated:	Tuesday 27 October, 2009
Source:
Industry Reference:	CVE-2004-0600
Protection Provided by:	Security Gateway R81, R80, R77, R75
Who is Vulnerable?
Vulnerability Description	Samba is an open-source implementation of the file, print, and other network services suite known as SMB/CIFS (Server Message Block/Common Internet File System). SWAT is a web-based administrative tool that allows an administrator to edit and view a Samba configuration. SWAT commonly listens on port TCP/901 for user connections. There is a vulnerability in the way SWAT, a web-based administration tool for Samba, parses basic authentication information. A specially crafted authentication string can cause an integer underflow leading to a heap-based buffer overflow. An attacker can exploit this vulnerability to create a denial of service condition or execute arbitrary code. When the vulnerability is triggered, the SWAT process will generate a segmentation fault signal and exit. Normally, inetd will spawn other SWAT processes for other requests. In certain cases, the attacker may be able to execute code on the target system with the privileges of this process. The behaviour of the target system, in this case, depends on the injected code.

Protection Overview

This protection will detect and block attempts to exploit this vulnerability

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R80 / R77 / R75

In the IPS tab, click Protections and find the Samba SWAT HTTP Authentication Buffer Overflow protection using the Search tool and Edit the protection's settings.
Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name: Application Servers Protection Violation.
Attack Information: Samba SWAT HTTP authentication buffer overflow