CVE-2004-1154 Integer overflow in the Samba daemon (smbd) in Samba 2.x and 3.0.x through 3.0.9 allows remote authenticated users to cause a denial of service (application crash) and possibly execute arbitrary code....
HighCVSS 10.0
EPSS 13.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Integer overflow in the Samba daemon (smbd) in Samba 2.x and 3.0.x through 3.0.9 allows remote authenticated users to cause a denial of service (application crash) and possibly execute arbitrary code via a Samba request with a large number of security descriptors that triggers a heap-based buffer overflow.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| samba | = 2.0.0 | No fix listed |
| samba | = 2.0.1 | No fix listed |
| samba | = 2.0.2 | No fix listed |
| samba | = 2.0.3 | No fix listed |
| samba | = 2.0.4 | No fix listed |
| samba | = 2.0.5 | No fix listed |
| samba | = 2.0.6 | No fix listed |
| samba | = 2.0.7 | No fix listed |
| samba | = 2.0.8 | No fix listed |
| samba | = 2.0.9 | No fix listed |
| samba | = 2.0.10 | No fix listed |
| samba | = 2.2.0 | No fix listed |
| samba | = 2.2.0a | No fix listed |
| samba | = 2.2.1a | No fix listed |
| samba | = 2.2.2 | No fix listed |
| samba | = 2.2.3 | No fix listed |
| samba | = 2.2.3a | No fix listed |
| samba | = 2.2.4 | No fix listed |
| samba | = 2.2.5 | No fix listed |
| samba | = 2.2.6 | No fix listed |
| samba | = 2.2.7 | No fix listed |
| samba | = 2.2.7a | No fix listed |
| samba | = 2.2.8 | No fix listed |
| samba | = 2.2.8a | No fix listed |
| samba | = 2.2.9 | No fix listed |
Show 29 more
| Product | Affected versions | Fixed in |
|---|---|---|
| samba | = 2.2.11 | No fix listed |
| samba | = 2.2.12 | No fix listed |
| samba | = 2.2a | No fix listed |
| samba | = 3.0.0 | No fix listed |
| samba | = 3.0.1 | No fix listed |
| samba | = 3.0.2 | No fix listed |
| samba | = 3.0.2a | No fix listed |
| samba | = 3.0.3 | No fix listed |
| samba | = 3.0.4 | No fix listed |
| samba | = 3.0.4-rc1 | No fix listed |
| samba | = 3.0.5 | No fix listed |
| samba | = 3.0.6 | No fix listed |
| samba | = 3.0.7 | No fix listed |
| samba | = 3.0.8 | No fix listed |
| samba | = 3.0.9 | No fix listed |
| redhat fedora core | = core_2.0 | No fix listed |
| redhat fedora core | = core_3.0 | No fix listed |
| suse linux | = 1.0 | No fix listed |
| suse linux | = 8.1 | No fix listed |
| suse linux | = 8.2 | No fix listed |
| suse linux | = 9.0 | No fix listed |
| suse linux | = 9.1 | No fix listed |
| suse linux | = 9.2 | No fix listed |
| trustix secure linux | = 2.0 | No fix listed |
| trustix secure linux | = 2.1 | No fix listed |
| trustix secure linux | = 2.2 | No fix listed |
| debian/samba(Debian:12) | < 3.0.10-1 | 3.0.10-1 |
| debian/samba(Debian:13) | < 3.0.10-1 | 3.0.10-1 |
| debian/samba(Debian:14) | < 3.0.10-1 | 3.0.10-1 |
References
- APPLE-SA-2005-03-21 vendor-advisory
- 13453 third-party-advisory
- 101643 vendor-advisory
- 57730 vendor-advisory
- DSA-701 vendor-advisory
- 20041216 Samba smbd Security Descriptor Integer Overflow Vulnerability third-party-advisory
- VU#226184 third-party-advisory us-government-resource
- SUSE-SA:2004:045 vendor-advisory
- RHSA-2005:020 vendor-advisory
- www.samba.org
- 11973 vdb-entry
- samba-msrpc-heap-corruption(18519) vdb-entry
- oval:org.mitre.oval:def:10236 signature vdb-entry
- oval:org.mitre.oval:def:1459 signature vdb-entry
- oval:org.mitre.oval:def:642 signature vdb-entry
- Debian Security Tracker CVE-2004-1154 vendor-advisory