4 ms·
So is this a RCE vulnerability that wouldn't be solved by using a memory safe language? Looks like a design issue and not an overflow or something.
by ericfrederich 9y ago
So is this a RCE vulnerability that wouldn't be solved by using a memory safe language?
Looks like a design issue and not an overflow or something.
- jra_samba 9y agoYes. There are 2 subsystems involved: (1). Load a shared library module and execute it. This has many uses inside Samba. (2). Allow a client request on an RPC pipe to be routed to an external process or library. This allows Samba to be built without embedding all the named pipe services inside it, which makes it a smaller binary for embedded vendors. Unfortunately an old commit connected the two subsystems together, re-using the shared library module existing code to find and load the service the client was asking for. There was insufficient sanitization of the requesting name which caused the problem. That's what the fix now does. A memory safe language would not have saved us here.