CVE-2007-6015 Stack-based buffer overflow in the send_mailslot function in nmbd in Samba 3.0.0 through 3.0.27a, when the "domain logons" option is enabled, allows remote attackers to execute arbitrary code via a GE...
HighCVSS 9.3
EPSS 27.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Stack-based buffer overflow in the send_mailslot function in nmbd in Samba 3.0.0 through 3.0.27a, when the "domain logons" option is enabled, allows remote attackers to execute arbitrary code via a GETDC mailslot request composed of a long GETDC string following an offset username in a SAMLOGON logon request.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| samba | = 2.0.1 | No fix listed |
| samba | = 2.0.2 | No fix listed |
| samba | = 2.0.3 | No fix listed |
| samba | = 2.0.4 | No fix listed |
| samba | = 2.0.5 | No fix listed |
| samba | = 2.0.6 | No fix listed |
| samba | = 2.0.7 | No fix listed |
| samba | = 2.0.8 | No fix listed |
| samba | = 2.0.9 | No fix listed |
| samba | = 2.0.10 | No fix listed |
| samba | = 2.2.0 | No fix listed |
| samba | = 2.2.0a | No fix listed |
| samba | = 2.2.1a | No fix listed |
| samba | = 2.2.2 | No fix listed |
| samba | = 2.2.3 | No fix listed |
| samba | = 2.2.3a | No fix listed |
| samba | = 2.2.4 | No fix listed |
| samba | = 2.2.5 | No fix listed |
| samba | = 2.2.6 | No fix listed |
| samba | = 2.2.7 | No fix listed |
| samba | = 2.2.7a | No fix listed |
| samba | = 2.2.8 | No fix listed |
| samba | = 2.2.8a | No fix listed |
| samba | = 2.2.9 | No fix listed |
| samba | = 2.2.11 | No fix listed |
Show 39 more
| Product | Affected versions | Fixed in |
|---|---|---|
| samba | = 2.2.12 | No fix listed |
| samba | = 3.0.0 | No fix listed |
| samba | = 3.0.1 | No fix listed |
| samba | = 3.0.2 | No fix listed |
| samba | = 3.0.2a | No fix listed |
| samba | = 3.0.10 | No fix listed |
| samba | = 3.0.11 | No fix listed |
| samba | = 3.0.12 | No fix listed |
| samba | = 3.0.13 | No fix listed |
| samba | = 3.0.14 | No fix listed |
| samba | = 3.0.14a | No fix listed |
| samba | = 3.0.20 | No fix listed |
| samba | = 3.0.20a | No fix listed |
| samba | = 3.0.20b | No fix listed |
| samba | = 3.0.21 | No fix listed |
| samba | = 3.0.21a | No fix listed |
| samba | = 3.0.21b | No fix listed |
| samba | = 3.0.21c | No fix listed |
| samba | = 3.0.22 | No fix listed |
| samba | = 3.0.23a | No fix listed |
| samba | = 3.0.23b | No fix listed |
| samba | = 3.0.23c | No fix listed |
| samba | = 3.0.23d | No fix listed |
| samba | = 3.0.24 | No fix listed |
| samba | = 3.0.25 | No fix listed |
| samba | = 3.0.25-pre1 | No fix listed |
| samba | = 3.0.25-pre2 | No fix listed |
| samba | = 3.0.25-rc1 | No fix listed |
| samba | = 3.0.25-rc2 | No fix listed |
| samba | = 3.0.25-rc3 | No fix listed |
| samba | = 3.0.25a | No fix listed |
| samba | = 3.0.25b | No fix listed |
| samba | = 3.0.25c | No fix listed |
| samba | = 3.0.26 | No fix listed |
| samba | = 3.0.26a | No fix listed |
| samba | = 3.0.27 | No fix listed |
| debian/samba(Debian:12) | < 3.0.28-1 | 3.0.28-1 |
| debian/samba(Debian:13) | < 3.0.28-1 | 3.0.28-1 |
| debian/samba(Debian:14) | < 3.0.28-1 | 3.0.28-1 |
References
- Debian Security Tracker CVE-2007-6015 vendor-advisory
- bugs.gentoo.org
- docs.info.apple.com
- APPLE-SA-2008-02-11 vendor-advisory
- [Security-announce] 20080221 VMSA-2008-0003 Moderate: Updated aacraid driver and samba and python service console updates mailing-list
- HPSBUX02316 vendor-advisory
- 27760 third-party-advisory vendor-advisory
- 27894 third-party-advisory
- 27977 third-party-advisory
- 27993 third-party-advisory
- 27999 third-party-advisory
- 28003 third-party-advisory
- 28028 third-party-advisory
- 28029 third-party-advisory
- 28037 third-party-advisory
- 28067 third-party-advisory
- 28089 third-party-advisory
- 28891 third-party-advisory
- 29032 third-party-advisory
- 29341 third-party-advisory
- 30484 third-party-advisory
- 30835 third-party-advisory
- secunia.com vendor-advisory
- GLSA-200712-10 vendor-advisory
- 3438 third-party-advisory
- SSA:2007-344-01 vendor-advisory
- 238251 vendor-advisory
- 1019295 vendor-advisory
- support.avaya.com
- DSA-1427 vendor-advisory
- VU#438395 third-party-advisory us-government-resource
- MDKSA-2007:244 vendor-advisory
- SUSE-SA:2007:068 vendor-advisory
- RHSA-2007:1114 patch vendor-advisory
- RHSA-2007:1117 vendor-advisory
- www.samba.org patch
- 20071210 Secunia Research: Samba "send_mailslot()" Buffer OverflowVulnerability mailing-list
- 20071210 [SECURITY] Buffer overrun in send_mailslot() mailing-list
- 20071210 rPSA-2007-0261-1 samba samba-swat mailing-list
- 20071214 POC for samba send_mailslot() mailing-list
- 20080221 VMSA-2008-0003 Moderate: Updated aacraid driver and samba and python service console updates mailing-list
- 26791 vdb-entry
- 1019065 vdb-entry
- USN-556-1 vendor-advisory
- TA08-043B third-party-advisory us-government-resource
- ADV-2007-4153 vdb-entry
- ADV-2008-0495 vdb-entry
- ADV-2008-0637 vdb-entry
- ADV-2008-0859 vdb-entry
- ADV-2008-1712 vdb-entry
- ADV-2008-1908 vdb-entry
- HPSBUX02341 vendor-advisory
- samba-sendmailslot-bo(38965) vdb-entry
- issues.rpath.com
- oval:org.mitre.oval:def:11572 signature vdb-entry
- oval:org.mitre.oval:def:5605 signature vdb-entry
- FEDORA-2007-4269 vendor-advisory
- FEDORA-2007-4275 vendor-advisory