CVE-2007-5398 Stack-based buffer overflow in the reply_netbios_packet function in nmbd/nmbd_packets.c in nmbd in Samba 3.0.0 through 3.0.26a, when operating as a WINS server, allows remote attackers to execute arbi...
HighCVSS 9.3
EPSS 11.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Stack-based buffer overflow in the reply_netbios_packet function in nmbd/nmbd_packets.c in nmbd in Samba 3.0.0 through 3.0.26a, when operating as a WINS server, allows remote attackers to execute arbitrary code via crafted WINS Name Registration requests followed by a WINS Name Query request.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| samba | = 3.0.0 | No fix listed |
| samba | = 3.0.1 | No fix listed |
| samba | = 3.0.2 | No fix listed |
| samba | = 3.0.2a | No fix listed |
| samba | = 3.0.3 | No fix listed |
| samba | = 3.0.4 | No fix listed |
| samba | = 3.0.4-rc1 | No fix listed |
| samba | = 3.0.5 | No fix listed |
| samba | = 3.0.6 | No fix listed |
| samba | = 3.0.7 | No fix listed |
| samba | = 3.0.8 | No fix listed |
| samba | = 3.0.9 | No fix listed |
| samba | = 3.0.10 | No fix listed |
| samba | = 3.0.11 | No fix listed |
| samba | = 3.0.12 | No fix listed |
| samba | = 3.0.13 | No fix listed |
| samba | = 3.0.14 | No fix listed |
| samba | = 3.0.14a | No fix listed |
| samba | = 3.0.15 | No fix listed |
| samba | = 3.0.16 | No fix listed |
| samba | = 3.0.17 | No fix listed |
| samba | = 3.0.18 | No fix listed |
| samba | = 3.0.19 | No fix listed |
| samba | = 3.0.20 | No fix listed |
| samba | = 3.0.20a | No fix listed |
Show 26 more
| Product | Affected versions | Fixed in |
|---|---|---|
| samba | = 3.0.20b | No fix listed |
| samba | = 3.0.21 | No fix listed |
| samba | = 3.0.21a | No fix listed |
| samba | = 3.0.21b | No fix listed |
| samba | = 3.0.21c | No fix listed |
| samba | = 3.0.22 | No fix listed |
| samba | = 3.0.23 | No fix listed |
| samba | = 3.0.23a | No fix listed |
| samba | = 3.0.23b | No fix listed |
| samba | = 3.0.23c | No fix listed |
| samba | = 3.0.23d | No fix listed |
| samba | = 3.0.24 | No fix listed |
| samba | = 3.0.25 | No fix listed |
| samba | = 3.0.25-pre1 | No fix listed |
| samba | = 3.0.25-pre2 | No fix listed |
| samba | = 3.0.25-rc1 | No fix listed |
| samba | = 3.0.25-rc2 | No fix listed |
| samba | = 3.0.25-rc3 | No fix listed |
| samba | = 3.0.25a | No fix listed |
| samba | = 3.0.25b | No fix listed |
| samba | = 3.0.25c | No fix listed |
| samba | = 3.0.26 | No fix listed |
| samba | = 3.0.26a | No fix listed |
| debian/samba(Debian:12) | < 3.0.27-1 | 3.0.27-1 |
| debian/samba(Debian:13) | < 3.0.27-1 | 3.0.27-1 |
| debian/samba(Debian:14) | < 3.0.27-1 | 3.0.27-1 |
References
- docs.info.apple.com
- APPLE-SA-2007-12-17 vendor-advisory
- [Security-announce] 20080107 VMSA-2008-0001 Moderate OpenPegasus PAM Authentication Buffer Overflow and updated service console packages mailing-list
- HPSBUX02316 vendor-advisory
- 27450 third-party-advisory vendor-advisory
- 27679 third-party-advisory
- 27682 third-party-advisory
- 27691 third-party-advisory
- 27701 third-party-advisory
- 27720 third-party-advisory
- 27731 third-party-advisory
- 27742 third-party-advisory
- 27787 third-party-advisory
- 27927 third-party-advisory
- 28136 third-party-advisory
- 28368 third-party-advisory
- 29341 third-party-advisory
- 30484 third-party-advisory
- 30835 third-party-advisory
- secunia.com
- 3372 third-party-advisory
- 1018953 vdb-entry
- SSA:2007-320-01 vendor-advisory
- 237764 vendor-advisory
- us1.samba.org
- DSA-1409 vendor-advisory
- GLSA-200711-29 vendor-advisory
- MDKSA-2007:224 vendor-advisory
- SUSE-SA:2007:065 vendor-advisory
- RHSA-2007:1013 vendor-advisory
- RHSA-2007:1016 vendor-advisory
- RHSA-2007:1017 vendor-advisory
- 20071115 Secunia Research: Samba "reply_netbios_packet()" Buffer OverflowVulnerability mailing-list
- 20080108 VMSA-2008-0001 Moderate OpenPegasus PAM Authentication Buffer Overflow and updated service console packages mailing-list
- 20080123 UPDATED VMSA-2008-0001.1 Moderate OpenPegasus PAM Authentication Buffer Overflow and updated service console packages mailing-list
- 26455 vdb-entry
- TA07-352A third-party-advisory us-government-resource
- www.vmware.com
- ADV-2007-3869 vdb-entry
- ADV-2007-4238 vdb-entry
- ADV-2008-0064 vdb-entry
- ADV-2008-0859 vdb-entry
- ADV-2008-1712 vdb-entry
- ADV-2008-1908 vdb-entry
- HPSBUX02341 vendor-advisory
- samba-replynetbiospacket-bo(38502) vdb-entry
- issues.rpath.com
- oval:org.mitre.oval:def:10230 signature vdb-entry
- oval:org.mitre.oval:def:5811 signature vdb-entry
- USN-544-1 vendor-advisory
- FEDORA-2007-3402 vendor-advisory
- Debian Security Tracker CVE-2007-5398 vendor-advisory