CVE-2015-0240 The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.1.17, and 4.2.x before 4.2.0rc5 performs a free operation on an uninitialized sta...
HighCVSS 10.0
EPSS 88.2%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.1.17, and 4.2.x before 4.2.0rc5 performs a free operation on an uninitialized stack pointer, which allows remote attackers to execute arbitrary code via crafted Netlogon packets that use the ServerPasswordSet RPC API, as demonstrated by packets reaching the _netr_ServerPasswordSet function in rpc_server/netlogon/srv_netlog_nt.c.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/samba(Debian:12) | < 2:4.1.17+dfsg-1 | 2:4.1.17+dfsg-1 |
| debian/samba(Debian:13) | < 2:4.1.17+dfsg-1 | 2:4.1.17+dfsg-1 |
| debian/samba(Debian:14) | < 2:4.1.17+dfsg-1 | 2:4.1.17+dfsg-1 |
| redhat enterprise linux | = 5 | No fix listed |
| redhat enterprise linux | = 6.0 | No fix listed |
| redhat enterprise linux | = 7.0 | No fix listed |
| samba | = 3.5.0 | No fix listed |
| samba | = 3.5.1 | No fix listed |
| samba | = 3.5.2 | No fix listed |
| samba | = 3.5.3 | No fix listed |
| samba | = 3.5.4 | No fix listed |
| samba | = 3.5.5 | No fix listed |
| samba | = 3.5.6 | No fix listed |
| samba | = 3.5.7 | No fix listed |
| samba | = 3.5.8 | No fix listed |
| samba | = 3.5.9 | No fix listed |
| samba | = 3.5.10 | No fix listed |
| samba | = 3.5.11 | No fix listed |
| samba | = 3.5.12 | No fix listed |
| samba | = 3.5.13 | No fix listed |
| samba | = 3.5.14 | No fix listed |
| samba | = 3.5.15 | No fix listed |
| samba | = 3.5.16 | No fix listed |
| samba | = 3.5.17 | No fix listed |
| samba | = 3.5.18 | No fix listed |
Show 74 more
| Product | Affected versions | Fixed in |
|---|---|---|
| samba | = 3.5.19 | No fix listed |
| samba | = 3.5.20 | No fix listed |
| samba | = 3.5.21 | No fix listed |
| samba | = 3.5.22 | No fix listed |
| samba | = 3.6.0 | No fix listed |
| samba | = 3.6.1 | No fix listed |
| samba | = 3.6.2 | No fix listed |
| samba | = 3.6.10 | No fix listed |
| samba | = 3.6.11 | No fix listed |
| samba | = 3.6.12 | No fix listed |
| samba | = 3.6.13 | No fix listed |
| samba | = 3.6.14 | No fix listed |
| samba | = 3.6.15 | No fix listed |
| samba | = 3.6.16 | No fix listed |
| samba | = 3.6.17 | No fix listed |
| samba | = 3.6.18 | No fix listed |
| samba | = 3.6.19 | No fix listed |
| samba | = 3.6.20 | No fix listed |
| samba | = 3.6.21 | No fix listed |
| samba | = 3.6.22 | No fix listed |
| samba | = 3.6.23 | No fix listed |
| samba | = 3.6.24 | No fix listed |
| samba | = 4.0.0 | No fix listed |
| samba | = 4.0.1 | No fix listed |
| samba | = 4.0.2 | No fix listed |
| samba | = 4.0.3 | No fix listed |
| samba | = 4.0.4 | No fix listed |
| samba | = 4.0.5 | No fix listed |
| samba | = 4.0.6 | No fix listed |
| samba | = 4.0.7 | No fix listed |
| samba | = 4.0.8 | No fix listed |
| samba | = 4.0.9 | No fix listed |
| samba | = 4.0.10 | No fix listed |
| samba | = 4.0.11 | No fix listed |
| samba | = 4.0.12 | No fix listed |
| samba | = 4.0.13 | No fix listed |
| samba | = 4.0.14 | No fix listed |
| samba | = 4.0.15 | No fix listed |
| samba | = 4.0.16 | No fix listed |
| samba | = 4.0.17 | No fix listed |
| samba | = 4.0.18 | No fix listed |
| samba | = 4.0.19 | No fix listed |
| samba | = 4.0.20 | No fix listed |
| samba | = 4.0.21 | No fix listed |
| samba | = 4.0.22 | No fix listed |
| samba | = 4.0.23 | No fix listed |
| samba | = 4.0.24 | No fix listed |
| samba | = 4.1.0 | No fix listed |
| samba | = 4.1.1 | No fix listed |
| samba | = 4.1.2 | No fix listed |
| samba | = 4.1.3 | No fix listed |
| samba | = 4.1.4 | No fix listed |
| samba | = 4.1.5 | No fix listed |
| samba | = 4.1.6 | No fix listed |
| samba | = 4.1.7 | No fix listed |
| samba | = 4.1.8 | No fix listed |
| samba | = 4.1.9 | No fix listed |
| samba | = 4.1.10 | No fix listed |
| samba | = 4.1.11 | No fix listed |
| samba | = 4.1.12 | No fix listed |
| samba | = 4.1.13 | No fix listed |
| samba | = 4.1.14 | No fix listed |
| samba | = 4.1.15 | No fix listed |
| samba | = 4.1.16 | No fix listed |
| samba | = 4.2.0-rc1 | No fix listed |
| samba | = 4.2.0-rc2 | No fix listed |
| samba | = 4.2.0-rc3 | No fix listed |
| samba | = 4.2.0-rc4 | No fix listed |
| novell suse linux enterprise desktop | = 12 | No fix listed |
| novell suse linux enterprise server | = 12 | No fix listed |
| novell suse linux enterprise software development kit | = 12 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.10 | No fix listed |
References
- Debian Security Tracker CVE-2015-0240 vendor-advisory
- bugs.debian.org issue-tracking
- advisories.mageia.org
- SUSE-SU-2015:0353 vendor-advisory
- SUSE-SU-2015:0371 vendor-advisory
- openSUSE-SU-2015:0375 vendor-advisory
- SUSE-SU-2015:0386 vendor-advisory
- openSUSE-SU-2016:1064 vendor-advisory
- openSUSE-SU-2016:1106 vendor-advisory
- openSUSE-SU-2016:1107 vendor-advisory
- HPSBGN03288 vendor-advisory
- HPSBUX03320 vendor-advisory
- RHSA-2015:0249 vendor-advisory
- RHSA-2015:0250 vendor-advisory
- RHSA-2015:0251 vendor-advisory
- RHSA-2015:0252 vendor-advisory
- RHSA-2015:0253 vendor-advisory
- RHSA-2015:0254 vendor-advisory
- RHSA-2015:0255 vendor-advisory
- RHSA-2015:0256 vendor-advisory
- RHSA-2015:0257 vendor-advisory
- GLSA-201502-15 vendor-advisory
- DSA-3171 vendor-advisory
- MDVSA-2015:081 vendor-advisory
- MDVSA-2015:082 vendor-advisory
- www.oracle.com
- 72711 vdb-entry
- 1031783 vdb-entry
- SSA:2015-064-01 vendor-advisory
- USN-2508-1 vendor-advisory
- access.redhat.com
- bugzilla.redhat.com
- securityblog.redhat.com exploit
- support.lenovo.com
- support.lenovo.com
- 36741 exploit
- www.samba.org vendor-advisory
- security.netapp.com