Secunia

Jesus Olmos Gonzalez has discovered a vulnerability in Filesys::SmbClientParser, which can be exploited by malicious people to compromise an application using the module.

The vulnerability is caused due to the module improperly escaping characters contained within e.g. the names of shared directories. This can be exploited to execute arbitrary commands by tricking the user into processing a specially crafted directory shared by a malicious SMB server.

The vulnerability is confirmed in version 2.7. Other versions may also be affected.

Solution
Do not connect to untrusted servers with applications using the module.

Provided and/or discovered by
Jesus Olmos Gonzalez, Internet Security Auditors

Changelog
Further details available in Customer Area

Original Advisory
http://packetstormsecurity.org/0807-exploits/smbclientparser-exec.txt

Deep Links
Links available in Customer Area